In addition to processing approximately 150 million individual tax returns and issuing more than 100 million refunds during the filing season, IRS provides a range of taxpayer services, including through telephones, written correspondence, and on its website. Based on recent data from IRS, compared to last year, IRS’s telephone service has improved in the 2016 filing season. From January 1 through March 26, 2016, IRS received about 38.2 million calls to its automated and live assistor telephone lines—a slight decrease compared to the same period last year. Of the 14.7 million calls seeking live assistance, IRS had answered 9.9 million calls—a 72 percent increase over the 5.7 million calls answered during the same period last year. Further, the average wait time to speak to an assistor also decreased from 24 to 10 minutes. IRS anticipated that 65 percent of callers seeking live assistance would receive it this filing season, which ended April 18. IRS’s performance for telephone service during the filing season as of March 26, 2016 has exceeded IRS’s anticipated level—74 percent of callers have received live assistance. IRS attributed this year’s improvements to a number of factors. As noted above, of the additional $290 million IRS received in December 2015, it allocated $178.4 million (61.5 percent) for taxpayer services to make measurable improvements in its telephone level of service. With the funds, IRS hired 1,000 assistors who began answering taxpayer calls in March, in addition to the approximately 2,000 seasonal assistors it had hired in fall 2015. To help answer taxpayer calls before March, IRS officials told us that they detailed 275 staff from one of its compliance functions to answer telephone calls. IRS officials said they believe this step was necessary because the additional funding came too late in the year to hire and train assistors to fully cover the filing season. IRS also plans to use about 600 full-time equivalents of overtime for assistors to answer telephone calls and respond to correspondence in fiscal year 2016. This compares to fewer than 60 full-time equivalents of overtime used in fiscal year 2015. However, IRS expects that the telephone level of service will decline after the filing season. As a result, the telephone level of service for the entire 2016 fiscal year is expected to be at 47 percent. As we reported in March 2016, IRS’s telephone level of service for the fiscal year has yet to reach the levels it had achieved in earlier years (see figure 1). In addition to answering telephone calls, IRS responds to millions of letters and other correspondence from taxpayers. In 2015, we reported that the percentage of correspondence cases in IRS’s inventory classified as “overage”—cases generally not processed within 45 days of receipt by IRS—has stayed close to 50 percent since fiscal 2013. Minimizing overaged correspondence is important because delayed responses may prompt taxpayers to write again, call, or visit a walk-in site. Moreover, an increasing overage rate could lead to more interest paid to taxpayers who are owed refunds. In March 2016, IRS officials attributed improvements made this filing season, in part, to assistors working overtime. These officials reported that IRS’s office that responds to taxpayer inquiries and handles adjustments had slightly more than 700,000 correspondence cases in inventory at the end of January and expect about 1 million cases in inventory by the end of April. They described IRS’s correspondence inventory as manageable, but steadily increasing. Officials said that, after the filing deadline, assistors will turn their attention to correspondence. IRS also offers online services to millions of taxpayers through its website, including tax forms and interactive tax assistance features. According to IRS, the agency wants to expand online service to provide greater convenience to taxpayers which has the potential to reduce costs in other areas, such as its telephone operations. We have made recommendations to IRS and the Department of the Treasury (Treasury), as well as a matter for congressional consideration, to assist IRS in improving its customer service. Examples include: Telephone and Correspondence. In December 2012, we recommended that IRS define appropriate levels of service for telephones as well as correspondence. IRS neither agreed nor disagreed with this recommendation and, as of October 2015, the agency had not developed these customer service goals. While IRS has taken some steps to modify services provided to taxpayers, a strategy would help determine the resources needed to achieve customer service goals. Recognizing the importance of such as strategy, in December 2014, we recommended that IRS systematically and periodically compare its telephone service to the best in business to identify gaps between actual and desired performance. IRS disagreed with this recommendation, noting that it is difficult to identify comparable organizations. We do not agree with IRS’s position; many organizations run call centers that would provide ample opportunities to benchmark IRS’s performance. Recognizing the need to improve performance responding to taxpayer correspondence, in December 2015, we recommended to Treasury that it include overage rates for handling taxpayer correspondence as a part of Treasury’s performance goals. Treasury neither agreed nor disagreed with this recommendation. Online Services. In April 2013, we recommended that IRS develop a long-term online strategy that should, for example, develop business cases for all new online services. In March 2016, IRS officials reported that IRS’s Future State initiative is intended to provide better service to taxpayers through multiple channels of communication, including online. We have not yet assessed IRS’s Future State initiative. However, a long- term comprehensive strategy for online services should help ensure that IRS is maximizing the benefit to taxpayers from this investment and reduce costs in other areas, such as for IRS’s telephone operations. Comprehensive Customer Service Strategy. In fall 2015, Treasury and IRS officials said they had no plans to develop a comprehensive customer service strategy or specific goals for telephone service tied to the best in the business and customer expectations. These officials told us that the agencies’ existing efforts were sufficient. However, we continue to believe that, without such a strategy, Treasury and IRS can neither measure nor effectively communicate to Congress the types and levels of customer service taxpayers should expect and the resources needed to reach those levels. Therefore, in December 2015, we suggested that Congress consider requiring that Treasury work with IRS to develop a comprehensive customer service strategy. In April 2016, IRS officials told us that the agency has established a team to consider our prior recommendations in developing a comprehensive customer service strategy or goals for telephone service. During the filing season many taxpayers learn that their private information has been stolen and they have been victims of IDT refund fraud. This generally occurs when the taxpayer attempts to file a tax return only to learn that one has already been filed under the taxpayer’s name. For these taxpayers, IRS has taken action to improve customer service related to IDT refund fraud. As we reported in March 2016, between the 2011 and 2015 filing seasons, IRS experienced a 430 percent increase in the number of telephone calls to its Identity Theft Toll- Free Line. As of March 19, 2016, IRS had received more than 1.1 million calls to this line. During this time, 77 percent of callers seeking assistance on this telephone line received it compared to 54 percent during the same period last year. Average wait times during the same period have also decreased—taxpayers were waiting an average of 14 minutes to talk to an assistor, a decrease from 27 minutes last year. As we reported in April 2016, billions of dollars have been lost to IDT refund fraud and this crime continues to be an evolving threat. IRS develops estimates of the extent of IDT refund fraud to help direct its efforts to identify and prevent the crime. While its estimates have inherent uncertainty, IRS estimated that it prevented or recovered $22.5 billion in fraudulent IDT refunds in filing season 2014 (see figure 2). However, IRS also estimated, where data were available, that it paid $3.1 billion in fraudulent IDT refunds. Because of the difficulties in knowing the amount of undetectable fraud, the actual amount could differ from these estimates. IRS has taken steps to address IDT refund fraud; however, it remains a persistent and continually changing threat. IRS recognized the challenge of IDT refund fraud in its fiscal year 2014-2017 strategic plan and increased resources dedicated to combating IDT and other types of refund fraud. In fiscal year 2015, IRS reported that it staffed more than 4,000 full-time equivalents and spent about $470 million on all refund fraud and IDT activities. As described above, IRS received an additional $290 million in fiscal year 2016 to improve customer service, IDT identification and prevention, and cybersecurity efforts. The agency plans to use $16.1 million of this funding to help prevent IDT refund fraud, among other things. As we reported in April 2016, the administration requested an additional $90 million and an additional 491 full-time equivalents for fiscal year 2017 to help prevent IDT refund fraud and reduce other improper payments. IRS estimates that this $90 million investment in IDT refund fraud and other improper payment prevention would help it protect $612 million in revenue in fiscal year 2017, as well as protect revenue in future years. As we previously reported, IRS also works with third parties, such as tax preparation industry participants, states, and financial institutions to try to detect and prevent IDT refund fraud. In March 2015, the Commissioner of the IRS convened a Security Summit with industry and states to improve information sharing and authentication. IRS officials said that 40 state departments of revenue and 20 tax industry participants have officially signed a partnership agreement to enact recommendations developed and agreed to by summit participants. IRS plans to invest a portion of the $16.1 million it received in fiscal year 2016 into identity theft prevention and refund fraud mitigation actions from the Security Summit. These efforts include developing an Information Sharing and Analysis Center where IRS, states, and industry can share information to combat IDT refund fraud. Even though IRS has prioritized combating IDT refund fraud, fraudsters adapt their schemes to identify weaknesses in IDT defenses, such as gaining access to taxpayers’ tax return transcripts through IRS’s online Get Transcript service. According to IRS officials, with access to tax transcripts, fraudsters can create historically consistent returns that are hard to distinguish from a return filed by a legitimate taxpayer. This can make it more difficult for IRS to identify and detect IDT refund fraud. Because identity thieves are “adaptive adversaries” who are constantly learning and changing their tactics as IRS develops new IDT strategies, IRS will need stronger pre-refund and post-refund strategies to combat this persistent and evolving threat. While there are no simple solutions, our past work has highlighted ways IRS can combat this threat. Improved authentication. Improving authentication could help IRS prevent fraud before issuing refunds. In January 2015, we reported that IRS’s authentication tools have limitations and recommended that IRS assess the costs, benefits and risks of its authentication tools. For example, individuals can obtain an e-file PIN by providing their name, Social Security number, date of birth, address, and filing status for IRS’s e-file PIN application. Identity thieves can easily find this information, allowing them to bypass some, if not all, of IRS’s automatic checks according to our analysis and interviews with tax software and return preparer associations and companies. After filing an IDT return using an e-file PIN, the fraudulent return would proceed through IRS’s normal return processing. In response to our recommendation, in November 2015, IRS developed guidance for its Identity Assurance Office to assess costs, benefits, and risk. According to IRS officials, this analysis will inform decision-making on authentication-related issues. IRS also noted that the methods of analysis for the authentication tools will vary depending on the different costs and other factors for authenticating taxpayers in different channels, such as online, phone, or in-person. In February 2016, IRS officials told us that the Identity Assurance Office plans to complete a strategic plan for taxpayer authentication across the agency in September 2016. While IRS is taking steps, it will still be vulnerable until it completes and uses the results of its analysis of costs, benefits, and risks to inform decision- making. W-2 Pre-refund Matching. Another pre-refund strategy is earlier matching of employer-reported wage information to taxpayers’ returns before issuing refunds. As we reported in August 2014, thieves committing IDT refund fraud take advantage of IRS’s “look-back” compliance model. Under this model, rather than holding refunds until completing all compliance checks, IRS issues refunds after conducting selected reviews, such as verifying identity by matching names and Social Security numbers and filtering for indications of fraud. However, we found that the wage information that employers report on the Form W- 2, Wage and Tax Statement (W-2), has generally been unavailable to IRS until after it issues most refunds. According to IRS, pre-refund matching would potentially save a substantial part of the billions of taxpayer dollars currently lost to fraudsters. Increasing electronically-filed (e-file) W-2s. In December 2015, the Consolidated Appropriations Act, 2016 amended the tax code to accelerate W-2 filing deadlines to January 31. This represents important progress. Building on that, other policy changes may also be needed in concert with moving W-2 deadlines. Agency officials and third-party stakeholders told us that these changes include lowering the employee threshold requirement for employers to e-file W-2s. Because of the additional time and resources associated with processing paper W-2s submitted by employers, Social Security Administration officials told us that a change in the e-file threshold would be needed to sufficiently increase the number of e-filed W-2s. Backlogs in paper W-2s could result in IRS receiving W-2 data after the end of the filing season. Therefore, we have suggested that Congress should consider providing the Secretary of the Treasury with the regulatory authority to lower the threshold for electronic filing of W-2s from 250 returns annually to between 5 to 10 returns, as appropriate. Assessing the costs and benefits of pre-refund W-2 matching. In August 2014 we reported that the wage information that employers report on Form W-2 is unavailable to IRS until after it issues most refunds. Also, if IRS had access to W-2 data earlier, it could match such information to taxpayers’ returns and identify discrepancies before issuing billions of dollars of fraudulent IDT refunds. We recommended that IRS assess the costs and benefits of accelerating W-2 deadlines. In response to our recommendation, IRS provided us with a report in September 2015 discussing (1) adjustments to IRS systems and work processes needed to use accelerated W-2 information, (2) the potential impacts on internal and external stakeholders, and (3) other changes needed to match W-2 data to tax returns prior to issuing refunds, such as delaying refunds until W-2 data are available. IRS’s analysis for this report will help it determine how to best implement pre-refund W-2 matching, given the new January 31 deadline for filing W-2s. Improving feedback on external leads. A post-refund strategy to combat IDT refund fraud involves IRS’s External Leads Program. This program involves financial institutions and other external parties providing information about emerging IDT refund trends and fraudulent returns that have passed through IRS detection systems. In August 2014, we reported that IRS provided limited feedback to external parties on IDT leads they submitted and offered external parties limited general information on IDT refund fraud trends. We recommended that IRS provide actionable feedback to all lead-generating third parties, and IRS neither agreed nor disagreed. However, in response to our recommendation, IRS took a number of steps. First, in November 2015, IRS reported that it had developed a database to track leads submitted by financial institutions and the results of those leads. IRS also stated that it had held two sessions with financial institutions to provide feedback on external leads provided to IRS. Second, in December 2015, IRS officials told us that the agency sent a customer satisfaction survey asking financial institutions for feedback on the external leads process. The agency was also considering other ways to provide feedback to financial institutions. Third, in April 2016, IRS officials told us that they plan to analyze preliminary survey results by mid-April 2016. Finally, IRS officials reported that the agency shared information with financial institutions in March 2016 and plans to do so on a quarterly basis. The next information sharing session is scheduled in June 2016. We are following up with IRS on these activities to determine the extent to which IRS has addressed our recommendation. In addition to securing taxpayer information to help prevent IDT refund fraud, there are additional concerns for maintaining security of taxpayer data. As we reported in March 2016, IRS has implemented numerous controls over key financial and tax processing systems; however, it had not always effectively implemented access and other controls, including elements of its information security program. Access controls are intended to prevent, limit, and detect unauthorized access to computing resources, programs, information, and facilities. These controls include identification and authentication, authorization, cryptography, audit and monitoring, and physical security controls, among others. In our most recent review in March 2016, we found that IRS had improved access controls, but some weaknesses remain. Examples include: Identifying and authenticating users—such as through user account-password combinations—provides the basis for establishing accountability and controlling access to a system. IRS established policies for identification and authentication, including requiring multifactor authentication for local and network access accounts, and establishing password complexity and expiration requirements. It also improved identification and authentication controls by, for example, expanding the use of an automated mechanism to centrally manage, apply, and verify password requirements. However, weaknesses in identification and authentication controls remained. For example, the agency used easily guessable passwords on servers supporting key systems. Authorization controls limit what actions users are able to perform after being allowed into a system. They should be based on the concept of “least privilege,” granting users the least amount of rights and privileges necessary to perform their duties. While IRS established policies for authorizing access to its systems, we found that it continued to permit excessive access in some cases. For example, users were granted rights and permissions in excess of what they needed to perform their duties, including for an application used to process electronic tax payment information and a database on a human resources system. Cryptography controls protect sensitive data and computer programs by rendering data unintelligible to unauthorized users and protecting the integrity of transmitted or stored data. IRS policies require the use of encryption and it continued to expand its use of encryption to protect sensitive data. However, key systems we reviewed had not been configured to encrypt sensitive user authentication data. IRS also had weaknesses in configuration management controls, which are intended to prevent unauthorized changes to information system resources (e.g., software and hardware), and provide assurance that systems are configured and operating securely. Specifically, while IRS developed policies for managing the configuration of its information technology (IT) systems and improved some configuration management controls, it did not, for example, ensure security patch updates were applied in a timely manner to databases supporting two key systems we reviewed, including a patch that had been available since August 2012. To its credit, IRS had established contingency plans for the systems we reviewed, which help ensure that when unexpected events occur, critical operations can continue without interruption or can be promptly resumed, and that information resources are protected. Specifically, IRS had established policies for developing contingency plans for its information systems and for testing those plans, as well as for implementing and enforcing backup procedures. Moreover, the agency had documented and tested contingency plans for its systems and improved continuity of operations controls for several systems. Nevertheless, the control weaknesses we found can be attributed in part to IRS’s inconsistent implementation of elements of its agency-wide information security program. The agency established a comprehensive framework for its program, including assessing risk for its systems, developing system security plans, and providing employees with security awareness and specialized training. However, IRS had not updated key mainframe policies and procedures to address issues such as comprehensively auditing and monitoring access. In addition, the agency had not fully addressed previously identified deficiencies or ensured that its corrective actions were effective. During our most recent review, IRS told us it had addressed 28 of our prior recommendations; however, we determined that 9 of these had not been effectively implemented. We concluded in our November 2015 report that the collective effect of the deficiencies in information security from prior years that continued to exist in fiscal year 2015, along with the new deficiencies we identified, were serious enough to merit the attention of those charged with governance of IRS and therefore represented a significant deficiency in IRS’s internal control over financial reporting systems as of September 30, 2015. To assist IRS in fully implementing its agency-wide information security program, we made two new recommendations to more effectively implement security-related policies and plans. In addition, to assist IRS in strengthening security controls over the financial and tax processing systems we reviewed, we made 43 technical recommendations in a separate report with limited distribution to address 26 new weaknesses in access controls and configuration management. Implementing these recommendations—in addition to the 49 outstanding recommendations from previous audits—will help IRS improve its controls for identifying and authenticating users. This, in turn, will allow IRS to limit users’ access to the minimum necessary to perform their job-related functions, protect sensitive data when they are stored or in transit, audit and monitor system activities, and physically secure its IT facilities and resources. In commenting on drafts of our reports presenting the results of our fiscal year 2015 audit, the IRS Commissioner stated that while the agency agreed with our new recommendations, it will review them to ensure that its actions include sustainable fixes that implement appropriate security controls balanced against IT and human capital resource limitations. In conclusion, this year’s tax filing season has generally gone smoothly and IRS has improved customer service. While IRS has some initiatives to review customer service and consider improvements, it still needs to develop a comprehensive strategy for customer service that will meet the needs of taxpayers. This strategy could include setting customer service goals as well as benchmarking and monitoring performance. IRS also needs to strengthen its defenses for addressing IDT refund fraud that is informed by assessing the cost, benefits, and risks of IRS’s various authentication options. Finally, weaknesses in information security can also increase the risk posed by IDT refund fraud. While IRS has made progress in implementing information security controls, it needs to continue to address weaknesses in access controls and configuration management and consistently implement all elements of its information security program. The risks to which the IRS and the public are exposed have been illustrated by recent incidents involving public-facing applications, highlighting the importance of securing systems that contain sensitive taxpayer and financial data. Chairman Roskam, Ranking Member Lewis, and Members of the Subcommittee, this concludes my statement. I look forward to answering any questions that you may have at this time. If you have any questions regarding this statement, please contact Jessica K. Lucas-Judy at (202) 512-9110 or LucasJudyJ@gao.gov, James R. McTigue, Jr. at (202) 512-9110 or mctiguej@gao.gov, Gregory C. Wilshusen at (202) 512-6244 or wilshuseng@gao.gov, or Nancy Kingsbury at (202) 512-2928 or kingsburyn@gao.gov. Other key contributors to this statement include Neil A. Pinney, Joanna M. Stamatiades, and Jeffrey Knott, (assistant directors); Dawn E. Bidne; Mark Canter; James Cook; Shannon J. Finnegan; Lee McCracken; Justin Palk; J. Daniel Paulk; Erin Saunders Rath; and Daniel Swartz. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: IRS provides service to tens of millions of taxpayers and processes most tax returns during the filing season. It is also a time when legitimate taxpayers may learn that they are a victim of IDT refund fraud, which occurs when a thief files a fraudulent return using a legitimate taxpayer's identity and claims a refund. In 2015, GAO added IDT refund fraud to its high-risk area on the enforcement of tax laws and expanded its government-wide high-risk area on federal information security to include the protection of personally identifiable information. With IRS's reliance on computerized systems, recent data breaches at IRS highlight the vulnerability of sensitive taxpayer information. This statement discusses IRS's efforts to address (1) customer service declines, (2) IDT refund fraud challenges, and (3) information security weaknesses. This statement is based on GAO reports issued between 2012 and 2016 and includes updates of selected data. The Internal Revenue Service (IRS) improved phone service to taxpayers during the 2016 filing season compared to last year. According to IRS, this is due in part to the additional $290 million in funding Congress provided to improve customer service, identity theft (IDT) refund fraud, and cybersecurity efforts. However, IRS expects its performance for the entire fiscal year will not reach the levels of earlier years. In 2012 and 2014, GAO made recommendations for IRS to improve customer service, which it has yet to implement. Consequently, in December 2015, GAO suggested that Congress require the Department of the Treasury (Treasury) to work with IRS to develop a comprehensive customer service strategy that incorporates elements of these prior recommendations. IDT refund fraud poses a significant challenge. Although the full extent of this fraud is unknown, IRS estimates it paid $3.1 billion in IDT fraudulent refunds in filing season 2014, while preventing the processing of $22.5 billion in fraudulent refunds (see figure). IRS has taken steps to combat IDT refund fraud, such as increasing resources dedicated to combating the problem. However, as GAO reported in August 2014 and January 2015, additional actions can further assist the agency, including assessing the costs, benefits, and risks of improving methods for authenticating taxpayers. In addition, the Consolidated Appropriations Act, 2016 included a provision to accelerate filings of W-2 information from employers to the IRS that would help IRS with pre-refund matching. GAO suggested that Congress provide Treasury with authority to lower the threshold for e-filing W-2s, which would further enhance pre-refund matching. In March 2016, GAO reported that IRS had instituted numerous controls over key financial and tax processing systems; however, it had not always effectively implemented other controls intended to properly restrict access to systems and information, among other security measures. While IRS had improved some of its access controls, weaknesses remained in controls over key systems for identifying and authenticating users, authorizing users' level of rights and privileges, and encrypting sensitive data. These weaknesses were due in part to IRS's inconsistent implementation of its agency-wide security program, including not fully implementing 49 prior GAO recommendations. GAO concluded that these weaknesses collectively constituted a significant deficiency for the purposes of financial reporting for fiscal year 2015. As a result, taxpayer and financial data continue to be exposed to increased risk. GAO previously suggested that Congress consider requiring that Treasury work with IRS to develop a customer service strategy, and providing Treasury with the authority to lower the annual threshold for e-filing W-2s. GAO made prior recommendations to IRS to combat IDT refund fraud, such as assessing the costs, benefits, and risks of taxpayer authentication options, and 45 new recommendations to further improve IRS's information security controls and the implementation of its agency-wide information security program.