Internal control is not one event, but a series of actions and activities that occur throughout an entity’s operations and on an ongoing basis. Internal control should be recognized as an integral part of each system that management uses to regulate and guide its operations rather than as a separate system within an agency. In this sense, internal control is management control that is built into the entity as a part of its infrastructure to help managers run the entity and achieve their goals on an ongoing basis. Section 3512 (c), (d) of Title 31, U.S. Code (commonly known as the Federal Managers’ Financial Integrity Act of 1982 (FMFIA)), requires agencies to establish and maintain internal control. The agency head must annually evaluate and report on the control and financial systems that protect the integrity of federal programs. The requirements of FMFIA serve as an umbrella under which other reviews, evaluations, and audits should be coordinated and considered to support management’s assertion about the effectiveness of internal control over operations, financial reporting, and compliance with laws and regulations. Office of Management and Budget (OMB) Circular No. A-123, Management’s Responsibility for Internal Control (revised Dec. 21, 2004), provides the implementing guidance for FMFIA, and sets out the specific requirements for assessing and reporting on internal controls consistent with the internal control standards issued by the Comptroller General of the United States. The circular, which was revised in 2004 with the revisions effective for fiscal year 2006, defines management’s responsibilities related to internal control and the process for assessing internal control effectiveness, and provides specific requirements for conducting management’s assessment of the effectiveness of internal control over financial reporting. The circular requires management to annually provide assurances on internal control in its Performance and Accountability Report, and for the Chief Financial Officers (CFO) Act agencies, beginning in fiscal year 2006, to include a separate assurance on internal control over financial reporting, along with a report on identified material weaknesses and corrective actions. The circular also emphasizes the need for integrated and coordinated internal control assessments that synchronize all internal control-related activities. FMFIA requires GAO to issue standards for internal control in the federal government. GAO’s Standards for Internal Control in the Federal Government provides the overall framework for establishing and maintaining internal control and for identifying and addressing major performance and management challenges and areas at greatest risk of fraud, waste, abuse, and mismanagement. As summarized in GAO’s Standards for Internal Control in the Federal Government, the minimum level of quality acceptable for internal control in the government is defined by the following five standards, which also provide the basis against which internal controls are to be evaluated: Control environment: Management and employees should establish and maintain an environment throughout the organization that sets a positive and supportive attitude toward internal control and conscientious management. Risk assessment: Internal control should provide for an assessment of the risks the agency faces from both external and internal sources. Control activities: Internal control activities help ensure that management’s directives are carried out. The control activities should be effective and efficient in accomplishing the agency’s control objectives. Information and communications: Information should be recorded and communicated to management and others within the entity who need it and in a form and within a time frame that enables them to carry out their internal control and other responsibilities. Monitoring: Internal control monitoring should assess the quality of performance over time and ensure that the findings of audits and other reviews are promptly resolved. The third control standard—internal control activities—helps ensure that management’s directives are carried out. Control activities are the policies, procedures, techniques, and mechanisms that enforce management’s directives. In other words, they are the activities conducted in the everyday course of business that accomplish a control objective, such as ensuring IRS employees successfully complete background checks prior to being granted access to taxpayer information and receipts. As such, control activities are an integral part of an entity’s planning, implementing, reviewing, and accountability for stewardship of government resources and achievement of effective results. A key objective in our annual audits of IRS’s financial statements is to obtain reasonable assurance about whether IRS maintained effective internal controls with respect to financial reporting, including safeguarding of assets, and compliance with laws and regulations. While all five internal control standards are critical and are used by us as a basis for evaluating the effectiveness of IRS’s internal controls, we place a heavy emphasis on testing control activities. This has resulted in the identification of significant deficiencies in certain internal controls over the years and recommendations for corrective action. The objectives of this report are to (1) assist IRS management in tracking the status of financial audit and financial management-related recommendations and the actions needed to address them and (2) demonstrate how the recommendations fit into IRS’s overall management and internal control structure. To accomplish these objectives, we evaluated the effectiveness of IRS’s corrective actions implemented in response to open recommendations during fiscal year 2005 as part of our fiscal years 2005 and 2004 financial audits. To report on the current status of the recommendations, we obtained the status of each recommendation and corrective action taken or planned as of April 2006, as reported to us by IRS. We then compared IRS’s assessment to our fiscal year 2005 audit findings and noted any differences between IRS’s and our conclusions regarding the status of each recommendation. In order to determine how these recommendations fit within IRS’s management and internal control structure, we compared the open recommendations, and the issues that gave rise to them, to the control activities listed in GAO’s Standards for Internal Control in the Federal Government and to the list of major factors and examples outlined in our Internal Control Management and Evaluation Tool. We also considered how the recommendations and the underlying issues were categorized in our prior reports, whether IRS had addressed in whole or in part the underlying control issues that gave rise to the recommendations, and other legal requirements and implementing guidance, such as OMB Circular No. A-123; FMFIA; and the Federal Information System Controls Audit Manual, GAO/AIMD-12.19.6 (revised June 2001). We conducted our review from December 2005 through May 2006 in accordance with U.S. generally accepted government auditing standards. We requested comments on a draft of this report from the Commissioner of Internal Revenue or his designee. We received written comments from the commissioner, which are reprinted in appendix II. IRS continues to make progress on addressing its significant financial management challenges. Over the years since we first began auditing IRS’s financial statements in fiscal year 1992, we have closed out over 200 financial management-related recommendations we made based on actions IRS has taken to improve its internal controls and operational efficiency. This includes 34 recommendations we are closing in fiscal year 2006 based on actions IRS took during the period covered by our fiscal year 2005 financial audit. At the same time, however, our audits continue to identify significant internal control deficiencies, resulting in our making further recommendations for corrective action, including 22 new financial management-related recommendations resulting from our fiscal year 2005 financial audit. These internal control deficiencies, and the resulting recommendations, can directly be traced to the control activities in GAO’s Standards for Internal Control in the Federal Government. As such, it is essential that they be fully addressed and resolved to strengthen IRS’s overall financial management and to assist it in achieving its goals and mission. In April 2005, we issued a report on the status of IRS’s efforts to implement corrective actions to address financial management recommendations stemming from our fiscal year 2004 and prior year financial audits and other financial management-related work. In that report, we identified 84 audit recommendations that at that time, remained open and thus required corrective action by IRS. A significant number of these recommendations had been open for several years, either because IRS had not taken corrective action or because the actions taken had not been effective in resolving the issues that gave rise to the recommendations. IRS continued to work to address many of the internal control deficiencies to which these open recommendations relate. In the course of performing our fiscal year 2005 financial audit, we identified numerous actions IRS took to address many of its internal control deficiencies. Based on IRS’s actions, which we were able to substantiate through our audit, we are able to close 34 of these prior years’ recommendations since we concluded that IRS’s actions effectively addressed the issues that gave rise to them. IRS considers another 23 of the prior years’ recommendations to be effectively addressed. However, we still consider them to be open either because we have not yet had time to verify the effectiveness of IRS’s actions—they occurred subsequent to completion of our audit testing and thus have not been verified, which is a prerequisite to our closing a recommendation—or because the actions taken did not fully address the issue that gave rise to the recommendation. However, continued efforts are needed by IRS to address its serious internal control weaknesses. While we are able to close 34 financial management recommendations made in prior years, this still leaves 50 recommendations from prior years that remain open, a significant number of which have been outstanding for several years. In some cases, as mentioned, IRS may have effectively addressed the issues that gave rise to the recommendations subsequent to our fiscal year 2005 audit testing; however, in many cases, our fiscal year 2005 audit determined that the actions taken to date had not effectively addressed the underlying internal control issues. Additionally, during our fiscal year 2005 audit, we identified additional internal control issues that will require corrective action by IRS. In a recent management report to IRS, we discussed these internal control issues, and made 22 new recommendations to IRS to address these new issues. Consequently, a total of 72 financial management-related recommendations are currently open and need to be addressed by IRS. Of these, we consider 64 to be short term and 8 to be long term. Appendix I presents a listing of (1) recommendations we have made based on our financial audits and other financial management-related work that we have not previously reported as closed, (2) the status of each of these recommendations and corrective actions taken or planned as of April 2006 as reported to us by IRS, and (3) our analysis of whether the issues that gave rise to the recommendations have been effectively and fully addressed based on the work performed during our fiscal year 2005 financial audit. The appendix lists the recommendations by the date on which the recommendation was made and by report number. An agency’s overall internal control environment comprises the plans, methods, and procedures that are used to meet its mission, goals, and objectives and, in doing so, supports its performance-based management. Internal control also serves as the first line of defense in safeguarding an agency’s assets and in preventing and detecting errors and mitigating the potential for fraud. Effective internal control assists program managers in achieving desired results through effective stewardship of public resources. Control activities, one of the five broad standards contained in GAO’s Standards for Internal Control in the Federal Government, are the policies, procedures, techniques, and mechanisms that enforce management’s directives. As such, they are an integral part of an entity’s planning, implementing, reviewing, and accountability for stewardship of government resources and achievement of results. GAO’s Standards for Internal Control in the Federal Government defines 11 control activities. These control activities can be further grouped into three broad categories: safeguarding of assets and security activities, including physical control over vulnerable assets, segregation of duties, controls over information processing, and access restrictions to and accountability for resources and records; proper recording and documenting of transactions, including appropriate documentation of transactions and internal control, accurate and timely reporting of transactions and events, and proper execution of transactions and events; and effective management review and oversight, including reviews by management at the functional or activity level, establishment and review of performance measures and indicators, management of human capital, and top level reviews of actual performance. Each of the open recommendations from our financial audits and financial management-related work, and the underlying issues that gave rise to them, can be traced back to the 11 control activities and their three broad categories. Table 1 presents a summary of the open recommendations, each tied back to the control activity to which it relates. As table 1 indicates, many of IRS’s open recommendations are tied to safeguarding and security issues. Specifically, 29 of the open recommendations, or 40 percent, relate to issues associated with IRS’s lack of effective controls over safeguarding of assets and security activities. Another 26 recommendations, or 36 percent, relate to issues associated with IRS’s inability to properly record and document transactions. The remaining 17 recommendations, or 24 percent, relate to issues associated with the lack of effective management review and oversight. Linking the open recommendations from our financial audits and other financial management-related work, and the issues that gave rise to them, to the internal control activities identified in GAO’s Standards for Internal Control in the Federal Government provides insight regarding their significance to IRS’s ability to effectively achieve the objectives associated with the control activities and, thus, to its overall mission and goals. On the following pages, we group the 72 open recommendations under the control activity to which the condition that gave rise to them most appropriately fits. We first define each control activity as presented in GAO’s Standards for Internal Control in the Federal Government and briefly identify some of the key IRS operations that fall under that control activity. Although not comprehensive, the descriptions are intended to help explain why the control activity is important for IRS and thus why implementing the recommendations would strengthen management and controls that support those operations. For each recommendation, we also indicate whether it is a short-term or long-term recommendation. Given IRS’s mission, the sensitivity of the data it maintains, and its processing of trillions of dollars of tax receipts each year, one of the most important control activities at IRS is the safeguarding of assets. Internal control should be designed to provide reasonable assurance regarding prevention or prompt detection of unauthorized acquisition, use, or disposition of an agency’s assets. We have grouped together the four control activities in GAO’s Standards for Internal Control in the Federal Government that relate to safeguarding of assets (including tax receipts) and security activities (such as limiting access to only authorized personnel): (1) physical control over vulnerable assets, (2) segregation of duties, (3) controls over information processing, and (4) access restrictions to and accountability for resources and records. An agency must establish physical control to secure and safeguard vulnerable assets. Examples include security for and limited access to assets such as cash, securities, inventories, and equipment which might be vulnerable to risk of loss or unauthorized use. Such assets should be periodically counted and compared to control records. IRS is charged with collecting over $2 trillion in taxes each year, a significant amount of which is collected in the form of checks and cash accompanied by tax returns and related information. IRS collects taxes both at its own facilities as well as at lockbox banks that operate under contract with the Treasury Department’s Financial Management Service (FMS) to provide processing services for certain taxpayer receipts for IRS. IRS acts as custodian for (1) the tax payments it receives until they are deposited in the General Fund of the U.S. Treasury and (2) the tax returns and related information it receives until they are either sent to the Federal Records Center or destroyed. IRS is also charged with controlling many other assets, such as computers and other equipment, but IRS’s legal responsibility to safeguard tax returns and the confidential information taxpayers provide in tax returns makes the effectiveness of its internal controls with respect to physical security essential. IRS receives cash and checks mailed to its service centers or lockbox banks with accompanying tax returns and information or payment vouchers and payments made in person at one of its offices. While adequate physical safeguards over receipts should exist throughout the year, it is especially important during the peak tax filing season. Each year during the weeks preceding and shortly after April 15, an IRS service center campus (SCC) may receive and process daily over 100,000 pieces of mail containing returns, receipts, or both. The dollar value of receipts each service center processes increases to hundreds of millions of dollars a day during the April 15 time frame. Of our 72 open recommendations, the following 13 open recommendations are designed to improve IRS’s physical controls over vulnerable assets. (See table 2.) Key duties and responsibilities need to be divided or segregated among different people to reduce the risk of error or fraud. This should include separating the responsibilities for authorizing transactions, processing and recording them, reviewing the transactions, and handling any related assets. No one individual should control all key aspects of a transaction or event. IRS employees are responsible for processing trillions of dollars of tax receipts each year, of which hundreds of billions are received in the form of cash or checks, and for processing hundreds of billions of dollars in refunds to taxpayers. Consequently, it is critical that IRS maintain appropriate separation of duties to allow for adequate oversight of staff and protection of these vulnerable resources so that no single individual would be in a position of both causing an error or irregularity and then concealing it. For example, when an IRS field office or lockbox bank receives taxpayer receipts and returns, it is responsible for depositing the cash and checks in a depository institution and forwarding the related information received to an SCC for further processing. In order to adequately safeguard receipts from theft, the person responsible for recording the information from the taxpayer receipts on a voucher should be different from the individual who prepares those receipts for transmittal to the SCC for further processing. The following three open recommendations would help IRS improve its separation of duties, which will in turn strengthen its controls over both tax receipts and refunds. (See table 3.) A variety of control activities are used in information processing. Examples include edit checks of data entered, accounting for transactions in numerical sequences, and comparing file totals with control totals. There are two broad groupings of information systems control—general control (for hardware such as mainframe, network, end-user environments) and application control (processing of data within the application software). General controls include entitywide security program planning, management, and backup recovery procedures, and contingency and disaster planning. Application controls are designed to help ensure completeness, accuracy, authorization, and validity of all transactions during application processing. IRS relies extensively on computerized systems to support its financial and mission-related operations. To efficiently fulfill its tax processing responsibilities, IRS relies extensively on interconnected networks of computer systems to perform various functions, such as collecting and storing taxpayer data, processing tax returns, calculating interest and penalties, generating refunds, and providing customer service. As part of our annual audits of IRS’s financial statements, we assess the effectiveness of IRS’s information security controls over key financial systems, data, and interconnected networks at IRS’s critical data processing facilities that support the processing, storage, and transmission of sensitive financial and taxpayer data. From that effort, we have identified over the years information security control weaknesses that impair IRS’s ability to ensure the confidentiality, integrity, and availability of its sensitive financial and taxpayer data. As of March 2006, there were 45 open recommendations from our information security work designed to improve IRS’s information security controls. Recommendations resulting from our information security work are reported separately and are not included in this report primarily because of the sensitive nature of some of these issues. However, the following six open recommendations are related to systems limitations and IRS’s need to review and resolve various exception reports that its systems generate. (See table 4.) We included reviews of exception reports in this control activity since they help ensure the integrity of IRS’s automated data. Access to resources and records should be limited to authorized individuals, and accountability for their custody and use should be assigned and maintained. Periodic comparison of resources with the recorded accountability should be made to help reduce the risk of errors, fraud, misuse, or unauthorized alteration. Because IRS deals with a large volume of cash and checks, it is imperative that it maintain strong controls over who has access to those assets, the records that track those assets, and sensitive taxpayer information. Although IRS has a number of both physical and information system controls in place, some of the issues we have identified in our financial audits over the years pertain to ensuring that those with direct access to these cash and checks are appropriately vetted before being granted access to taxpayer receipts and information and to ensuring that IRS maintains effective access security control. The following seven open recommendations would help IRS improve its access restrictions to assets and records. (See table 5.) One of the largest obstacles continuing to face IRS management is the agency’s lack of an integrated financial management system capable of producing the accurate, useful, and timely information IRS managers need to assist in making day-to-day decisions. While progress is being made to modernize its financial management capabilities, IRS nonetheless continues to face many of the pervasive internal control weaknesses that we have reported each year since we began auditing its financial statements in fiscal year 1992, many of which are related to its long- standing systems deficiencies. However, IRS also has a number of internal control issues that relate to recording transactions, documenting events, and tracking the processing of taxpayer receipts or information, which do not depend upon improvements in information systems. We have grouped three control activities together that relate to proper recording and documenting of transactions: (1) appropriate documentation of transactions and internal controls, (2) accurate and timely recording of transactions and events, and (3) proper execution of transactions and events. Internal control and all transactions and other significant events need to be clearly documented, and the documentation should be readily available for examination. The documentation should appear in management directives, administrative policies, or operating manuals and may be in paper or electronic form. All documentation and records should be properly managed and maintained. IRS collects and processes trillions of dollars in taxpayer receipts annually both at its own facilities and at lockbox banks under contract to process taxpayer receipts for the federal government. Therefore, it is important that IRS maintain appropriate assurance that all documents and records are properly managed and maintained both at its facilities and at the lockbox banks. The following 11 open recommendations would assist IRS in improving its documentation of transactions and internal control procedures. (See table 6.) Transactions should be promptly recorded to maintain their relevance and value to management in controlling operations and making decisions. This applies to the entire process or life cycle of a transaction or event from the initiation and authorization through its final classification in summary records. In addition, control activities help to ensure that all transactions are completely and accurately recorded. IRS is responsible for maintaining taxpayer records for tens of millions of taxpayers in addition to maintaining its own financial records. To carry out this responsibility, IRS often has to rely on outdated computer systems or manual work-arounds. Unfortunately, some of IRS’s recordkeeping difficulties we have reported on over the years will not be addressed until it can replace its aging systems, which is a long-term effort and is dependent on future funding. The following 14 open recommendations would strengthen IRS’s recordkeeping abilities. (See table 7.) They include some specific recommendations regarding requirements for new systems for maintaining taxpayer records. Several of the recommendations listed affect financial reporting processes, such as subsidiary records and appropriate allocation of costs. Some of the issues that gave rise to certain of our recommendations directly affect taxpayers, such as those involving duplicate assessments, errors in calculating and reporting manual interest, and recovery of trust fund penalty assessments. Half of these recommendations are almost over 5 years old and 1 is over 10 years old, reflecting the long-term nature of the resolution of some of these issues. Transactions and other significant events should be authorized and executed only by persons acting within the scope of their authority. This is the principal means of assuring that only valid transactions to exchange, transfer, use, or commit resources and other events are initiated or entered into. Authorizations should be clearly communicated to managers and employees. IRS employs tens of thousands of people in its 10 SCCs, three computing centers, and numerous field offices throughout the United States. In addition, the number of staff increases significantly during the peak of the tax filing season. Because of the tremendous number of personnel involved, IRS must maintain effective control over which employees are authorized to either view or change sensitive taxpayer data. IRS’s ability to establish access rights and permissions for information systems is a critical control. Each year, IRS pays out hundreds of billions of dollars in tax refunds, some of which are distributed to taxpayers manually. IRS requires that all manual refunds be approved by officials who are designated by managers. However, weaknesses in the authorization of such approving officials expose the federal government to losses because of the issuance of improper refunds. The following open recommendation would improve IRS’s controls over its manual refund transactions. (See table 8.) All personnel within IRS have an important role in making internal controls work, but the responsibility for good internal control rests with IRS’s managers. Management sets the objectives, puts the control mechanisms and activities in place, and monitors and evaluates the controls. Without effective monitoring by managers, internal control activities may not be conducted on a consistent and timely basis. We have grouped three control activities together related to effective management review and oversight: (1) reviews by management at the functional or activity level, (2) establishment and review of performance measures and indicators, and (3) management of human capital. Although we also include the control activity “top level reviews of actual performance” in this grouping, we do not have any open recommendations to IRS related to this internal control activity. Managers need to compare actual performance to planned or expected results throughout the organization and analyze significant differences. IRS has over 80,000 full-time employees and hires over 10,000 seasonal personnel to assist during the tax filing season. In addition, as discussed earlier, IRS contracts with banks to process tens of thousands of individual receipts, totaling hundreds of billions of dollars. At any organization, management oversight of operations is important, but with an organization as vast in scope as the IRS, management oversight is imperative. The following 12 open recommendations would improve IRS’s management oversight. (See table 9.) In general, these recommendations were made to correct instances where an internal control activity either does not exist or where an established control is not being adequately or consistently applied. The majority of these recommendations emphasize improvements needed to IRS’s oversight of lockbox banks and contracted courier programs in order to ensure appropriate physical control over vulnerable assets, such as taxpayer receipts. Activities need to be established to monitor performance measures and indicators. These controls could call for comparisons and assessments relating different sets of data to one another so that analyses of the relationships can be made and appropriate actions taken. Controls should also be aimed at validating the propriety and integrity of both organizational and individual performance measures and indicators. IRS’s operations include a vast array of activities encompassing taxpayer education, processing of taxpayer receipts and data, disbursing hundreds of billions of dollars in refunds to millions of taxpayers, maintaining extensive information on tens of millions of taxpayers, and seeking collection from individuals and businesses that fail to comply with the nation’s tax laws. Within its compliance function, IRS has numerous activities, including identifying businesses and individuals that underreport income, collecting from taxpayers that do not pay, and collecting from those receiving refunds for which they are not eligible. Although IRS has at its peak over 90,000 employees, it still faces resource constraints in attempting to fulfill its duties. Because of this, it is vitally important for IRS to have sound performance measures to assist it in assessing its performance and targeting its resources in a manner that maximizes the government’s return on investment. However, in past audits we have reported that IRS did not capture cost at the program or activity level to assist in developing cost-based performance measures for its various programs and activities. As a result, IRS is unable to measure the costs and benefits of its various collection and enforcement efforts to best target its available resources. Additionally, we have reported that IRS’s controls over its reporting of interim performance measurement data were not effective throughout the year because the data reported at interim periods for certain performance measures were either not accurate or were outdated. The following four open recommendations are designed to assist IRS in evaluating its operations, determining which activities are the most beneficial, and establishing a good system for oversight. (See table 10.) These recommendations call for IRS to measure, track, and evaluate the cost, benefits, or outcomes of its operations—particularly with regard to identifying its most effective tax collection activities. Effective management of an organization’s workforce—its human capital—is essential to achieving results and an important part of internal control. Management should view human capital as an asset rather than a cost. Only when the right personnel for the job are on board and are provided the right training, tools, structure, incentives, and responsibilities is operational success possible. Management should ensure that skill needs are continually assessed and that the organization is able to obtain a workforce that has the required skills that match those necessary to achieve organizational goals. Training should be aimed at developing and retaining employee skill levels to meet changing organizational needs. Qualified and continuous supervision should be provided to ensure that internal control objectives are achieved. Performance evaluation and feedback, supplemented by an effective reward system, should be designed to help employees understand the connection between their performance and the organization’s success. As a part of its human capital planning, management should also consider how best to retain valuable employees, plan for their eventual succession, and ensure continuity of needed skills and abilities. IRS’s operations cover a wide range of technical competencies with specific expertise needed in tax-related matters; financial management; and systems design, development, and maintenance. Because IRS has tens of thousands of employees spread throughout the country, management’s responsibility to keep its guidance up-to-date and its staff properly trained is imperative. The following open recommendation would assist IRS in its management of human capital in its financial operations. (See table 11.) The recommendation is over 5 years old and may be resolved through IRS’s business systems modernization efforts. Increased budgetary pressures and an increased public awareness of the importance of internal control require IRS to operate more efficiently and more effectively in its mission while protecting taxpayers and their information. Sound financial management and effective internal controls can assist IRS in achieving its goals. IRS has made substantial progress in improving its financial management since its first financial audit, as evidenced by consecutive clean audit opinions on its financial statements for the past 6 years, resolution of several material internal control weaknesses, and the closing of hundreds of financial management recommendations. This progress has been the result of hard work and commitment at the top. Nonetheless, more needs to be done to fully address the financial management challenges the agency faces. Efforts must continue to address the internal control deficiencies that continue to exist. Effective implementation of the recommendations we have made and continue to make through our financial audits and related work could greatly assist IRS in improving its internal controls and achieving sound financial management. In commenting on a draft of this report, IRS expressed its appreciation that we acknowledged the progress the agency has made in addressing its financial management challenges, and noted that our mapping of its remaining recommendations to specific internal control activities and grouping them into three broad categories will facilitate its strategy to address the remaining financial management issues. IRS also highlighted its efforts to further improve its internal controls over hard-copy tax receipts, noting that its plan to address these issues now includes comprehensive actions to address our remaining recommendations covering lockbox banks, submission processing campuses, taxpayer assistance centers, and field offices. We will review the effectiveness of these corrective actions and the status of IRS’s progress in addressing all open recommendations as part of our fiscal year 2006 IRS financial statement audit. We are sending copies of this report to the Chairmen and Ranking Minority Members of the Senate Committee on Appropriations; Senate Committee on Finance; Senate Committee on Homeland Security and Governmental Affairs; and Subcommittee on Taxation and IRS Oversight, Senate Committee on Finance. We are also sending copies to the Chairmen and Ranking Minority Members of the House Committee on Appropriations; House Committee on Ways and Means; Chairman and Vice Chairman of the Joint Committee on Taxation, the Secretary of the Treasury, the Director of the Office of Management and Budget, the Chairman of the IRS Oversight Board, and other interested parties. Copies will be made available to others upon request. In addition, the report will be available at no charge on GAO’s Web site at http://www.gao.gov. If you have any questions concerning this report, please contact me at (202) 512-3406 or sebastians@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs can be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix III. Financial Management: Important IRS Revenue Information Is Unavailable or Unreliable (GAO/AIMD-94-22, Dec. 21, 1993) Open. The five errors identified in the FY05 Financial Statement Audit were resolved. The Complex Interest Quality Measurement System (CIQMS) staff assisted GAO with their sample review for the FY06 Audit. Once GAO completes their audit, CIQMS will continue to provide assistance as subject matter experts. Open. In testing a statistical sample of 45 manual interest transactions recorded during fiscal year 2005, we found five errors relating to the calculation and recording of manually calculated interest. We estimate that 11 percent of IRS’s manual interest population contains errors and concluded that IRS controls over this area remain ineffective. We will continue to test the accuracy of IRS’s manual interest calculations during our fiscal year 2006 financial audit. Manually review and eliminate duplicate or other assessments that have already been paid off to assure all accounts related to a single assessment are appropriately credited for payments received. (short-term) Internal Revenue Service: Immediate and Long-Term Actions Needed to Improve Financial Management (GAO/AIMD-99-16, Oct. 30, 1998) Open. IRS has taken several actions to strengthen controls and correct programming or procedural deficiencies in the cross referencing of payments. To ensure quality, timeliness, and accuracy of the Trust Fund Recovery Penalty (TFRP) process, the IRS initiated a quality review process that focused in two primary areas. The first being consolidation of all TFRP work to one campus. Consolidation of all SB/SE Automated Trust Fund Recovery (ATFR) work to the Ogden campus was completed in September 2005. All Wage & Investment (W&I) business unit TFRP work was transferred to SB/SE Campuses as of January 2006. The second area IRS undertook was the task of rewriting the ATFR area office user component to provide system flexibility that better replicates the realities of the current trust fund investigation/ proposal process. The enhanced rewrite has been delivered and is in production testing. Training is scheduled to begin in June 2006 with a complete nationwide deployment by the end of fiscal year 2006. IRS continues to monitor the accuracy and effectiveness of the TFRP process and all corrective actions already in place. Open. We recognize automation of the current TFRP program is much needed. However, IRS’s efforts to date have not been effective. In fiscal year 2005, we reviewed a statistical sample of 80 TFRP payments made on accounts established since August 2001. We found six instances in which IRS did not properly record the payment to all related taxpayer accounts. We estimate that 7.5 percent of these payments may not be properly recorded. We will continue to review IRS’s initiatives to improve posting of TFRP cases and test TFRP cases for proper postings to all related accounts as part of our fiscal year 2006 financial audit. Ensure that IRS’s modernization blueprint includes developing a subsidiary ledger to accurately and promptly identify, classify, track, and report all IRS unpaid assessments by amount and taxpayer. This subsidiary ledger must also have the capability to distinguish unpaid assessments by category in order to identify those assessments that represent taxes receivable versus compliance assessments and write-offs. In cases involving trust fund recovery penalties, the subsidiary ledger should ensure that (1) the trust fund recovery penalty assessment is appropriately tracked for all taxpayers liable but counted only once for reporting purposes and (2) all payments made are properly credited to the accounts of all individuals assessed for the liability. (short- term) Internal Revenue Service: Immediate and Long-Term Actions Needed to Improve Financial Management (GAO/AIMD-99-16, Oct. 30, 1998) Open. The Custodial Accounting Project (CAP) has been canceled due to budget constraints. The IRS chief financial officer (CFO) has developed a TFRP database that can establish the links and identify problems to more accurately report a single balance due for these assessments and determine areas for improvement in the TFRP program. The TFRP database is the first Release of the Financial Management Information System’s (FMIS) enhancement to the Custodial Detail Data Base (CDDB) that has been proposed to enable the IRS CFO to address many of the outstanding financial management recommendations. FMIS/CDDB Release 1, TFRP database will be tested and fully implemented in 2006. Further releases of FMIS/CDDB functionality are contingent on future funding levels. Open. We will continue to monitor IRS’s development of an alternative strategy for CAP, as well as its implementation of the new FMIS/CDDB. If IRS implements CDDB Release 1 for fiscal year 2006, we will perform tests of these data as part of our fiscal year 2006 audit. Ensure that all returned refund checks are stamped “nonnegotiable” as soon as they are extracted. (short-term) Internal Revenue Service: Physical Security Over Taxpayer Receipts and Data Needs Improvement (GAO/AIMD-99-15, Nov. 30, 1998) Closed. A memorandum is issued to Submission Processing (SP) Field Directors prior to filing season reinforcing the importance of ensuring SP procedures and policies regarding overstamping of returned refund checks are followed. In addition, this requirement is part of the Campus Monthly Security Reviews. All findings are shared with SP Field Directors. Local management continues to remind employees of the importance of overstamping returned refund checks on a regular basis through individual and group meetings to ensure compliance with the Internal Revenue Manual (IRM) and security requirements. Closed. During our fiscal year 2005 audit, we found no instances where returned refund checks were not stamped “nonnegotiable” upon extraction at the four SCCs we visited. Ensure that walk-in payment receipts are recorded in a control log prior to depositing the receipts in the locked container and ensure that the control log information is reconciled to receipts prior to submission of the receipts to another unit for payment processing. To ensure proper segregation of duties, an employee not responsible for logging receipts in the control log should perform the reconciliation. (short- term) Internal Revenue Service: Physical Security Over Taxpayer Receipts and Data Needs Improvement (GAO/AIMD-99-15, Nov. 30, 1998) Open. During our fiscal year 2005 audit, we found a lack of segregation of duties related to the preparation, review, and/or reconciliation of Form 795 at six of the eight TACs we visited. At three of these TACs, at times only one employee was present to carry out the functions of the office. At another TAC, there was no evidence that the Form 795 was reconciled by an employee other than the employee who received the payment from the taxpayer and recorded it on the Form 795. At this same TAC, we observed two instances where employees did not log information onto the Form 795 upon receipt. At the fifth TAC, the employee responsible for receiving and recording payments on the control log did not receive an independent reconciliation of the payments before they were mailed to the SCC for further processing. At the sixth TAC, one employee retrieved all the checks from the locked container and logged all the checks received onto a Form 795 and sent them to the SCC without a supervisor or designee review. The corrective actions cited by IRS were subsequent to our fieldwork at those locations. We will evaluate IRS’s corrective actions during our fiscal year 2006 audit. Field Assistance headquarters began conducting operational reviews on February 28, 2006. The operational reviews include assessing their ability to engage employees in process and program improvement, identifying best practice ideas, ensuring elements of accountability and responsibility are clearly communicated at each level, and assessing conformance to the current policies and procedures. Analyze and determine the factors causing delays in processing and posting TFRP assessments. Once these factors have been determined, IRS should develop procedures to reduce the impact of these factors and to ensure timely posting to all applicable accounts and proper offsetting of refunds against unpaid assessments before issuance. (short-term) Internal Revenue Service: Custodial Financial Management Weaknesses (GAO/AIMD-99-193, Aug. 4, 1999) Open. To ensure quality, timeliness, and accuracy of the TFRP process, the IRS initiated a quality review process that focused in two primary areas. The first being consolidation of all TFRP work to one campus. Consolidation of all SB/SE ATFR work to the Ogden campus was completed in September 2005. All W&I business unit TFRP work was transferred to SB/SE Campuses as of January 2006. The second area IRS undertook was the task of rewriting the ATFR area office user component to provide system flexibility that better replicates the realities of the current trust fund investigation/proposal process. The enhanced rewrite has been delivered and is in production testing. Training is scheduled to begin in June 2006 with a complete nationwide deployment by the end of fiscal year 2006. IRS continues to monitor the accuracy and effectiveness of the TFRP process and all corrective actions already in place. Open. We will continue to review IRS’s initiatives to improve posting of TFRP cases and monitor trust fund recovery penalty processing timeliness as part of our fiscal year 2006 audit. Internal Revenue Service: Custodial Financial Management Weaknesses (GAO/AIMD-99-193, Aug. 4, 1999) Closed. The guidelines in the Fiscal Year 2003 Operating Procedures for TACs for safeguarding receipts in locked containers and over-stamping checks made payable to IRS were incorporated into the IRM in June 2003. The requirement for over- stamping checks made payable to the IRS has been emphasized. Operational reviews by Field Assistance Headquarters are planned to ensure adherence to safeguarding of receipts and over- stamping requirements. Employees have been instructed to keep all containers locked that contain taxpayer data. Each employee will be provided individual performance feedback regarding any security violations. More frequent security reviews will be conducted that include this and other areas relating to protection of taxpayer data. Additional emphasis will be placed on development of internal controls and the oversight and accountability of both employees and managers within Field Assistance. Open. While IRS has taken steps to address this recommendation, the current response does not entail expansion of IRS’s service center security reviews and TAC operational reviews to the non- W&I business units. During our fiscal year 2005 audit, we found several instances where controls over safeguarding taxpayer receipts and information at the SB/SE, the Large and Mid-Size Business (LMSB), and Tax Exempt and Government Entities (TE/GE) field office units were not effective. We will evaluate IRS’s corrective actions during our fiscal year 2006 audit. Ensure that additional staff are employed or existing staff appropriately cross- trained to be able to perform the master file extractions and other ad hoc procedures needed for IRS to continually develop reliable balances for financial reporting purposes. (short-term) Internal Revenue Service: Custodial Financial Management Weaknesses (GAO/AIMD-99-193, Aug. 4, 1999) Open. The CAP has been stopped due to budget cuts. The IRS has decided to address this recommendation by enhancing the Service’s existing FMIS with a new database, the CDDB and the Interim Revenue Accounting Control System (IRACS) used to support the financial audit. The CFO has developed a business case and will pursue opportunities to identify resources within the IRS’s Information Technology budget to fund this effort. The need to build an appropriate depth of experience is still an immediate and ongoing issue. The IRS continues to examine its resources to see if work can be realigned, and if existing employees can be retrained. Contractor support is used to provide the support and backup necessary for preparation of the compensating procedures, pending implementation of the CDDB and the Customer Account Data Engine (CADE). IRS is committed to supporting the funding of contractor resources that are used for the financial statement audit. This corrective action will be continually monitored. Open. In fiscal year 2005, IRS continued to augment its own resources with contractor support to produce auditable financial statements. We will continue to assess IRS’s actions during our fiscal year 2006 audit. Develop the data to support meaningful cost information categories and cost- based performance measures. (long-term) Internal Revenue Service: Serious Weaknesses Impact Ability to Report on and Manage Operations (GAO/AIMD-99-196, Aug. 9, 1999) Open. Integrated Financial System (IFS) Release 1, which was implemented on November 10, 2004, includes a cost module that will interface with program area management information systems. Both direct and indirect resource cost data will be linked to the budget process and the strategic planning goals of all business units. This will help move IRS forward in transitioning to a performance- based organization. Full cost accounting will not be realized until future releases, such as Work Management, are implemented. An integrated Work Management module would routinely provide a greater level of detail for costing purposes. However, at present, all future releases are being reevaluated based on funding availability and no future implementation date has been established. Open. We will follow up during future audits to assess IRS’s progress in implementing a cost- accounting system and populating it with the cost information needed to support meaningful cost-based performance measures. Internal Revenue Service: Serious Weaknesses Impact Ability to Report on and Manage Operations (GAO/AIMD-99-196, Aug. 9, 1999) Open. In IFS Release 1, implemented on November 10, 2004, P&E are being recorded as an asset when purchased. The ability to tie to the detailed physical asset information and a fully integrated system with subsidiary records will not be available until the IFS Asset Management module is implemented. At present, all future releases are being reevaluated based on funding availability and no future implementation date has been established. Open. IRS implemented the first release of the new IFS on November 10, 2004, which allowed recording P&E as assets when purchased. However, implementation of a property asset module that is intended to generate detailed records for P&E that will reconcile to the financial records is being deferred indefinitely due to funding constraints. We will continue to monitor IRS’s progress in implementing subsequent IFS releases and the property asset module. As an alternative to prematurely suspending active collection efforts, and using the best available information, develop reliable cost- benefit data relating to collection efforts for cases with some collection potential. These cost-benefit data would include the full cost associated with the increased collection activity (i.e., salaries, benefits, and administrative support) as well as the expected additional tax collections generated. (short-term) Internal Revenue Service: Recommendations to Improve Financial and Operational Management (GAO-01-42, Nov. 17, 2000) Open. Based on initial success with modeling technology, SB/SE has initiated several other projects to build additional decision analytical models to increase our ability to route cases to the appropriate resource. These projects include the addition of external credit scores and other internal data to build more robust models with increased predictive power. These efforts will continue to help IRS ensure that the right resources are devoted to the appropriate cases. IRS has developed a corporate strategy for working collections cases. The Collection Governance Board (consisting of executives from SB/SE and W&I) was established in August 2005 to ensure inventory is balanced and resources are expended appropriately. Open. We will continue to review IRS’s initiatives to manage resource allocation levels for its collection efforts. Implement procedures to closely monitor the release of tax liens to ensure that they are released within 30 days of the date the related tax liability is fully satisfied. As part of these procedures, IRS should carefully analyze the causes of the delays in releasing tax liens identified by our work and prior work by IRS’s former internal audit function and ensure that such procedures effectively address these issues. (short-term) Internal Revenue Service: Recommendations to Improve Financial and Operational Management (GAO-01-42, Nov. 17, 2000) Open. IRS has redeveloped the prior action plan to incorporate the requirements of the revised OMB Circular No. A-123. The overall action addresses untimely lien releases, including identification of root causes and where they occur organizationally. Open. During our fiscal year 2005 audit, we continued to find delays in release of liens. We found 13 instances out of 59 cases tested in which IRS did not release the applicable federal tax lien within the 30-day statutory period. The time between the satisfaction of the liability and release of the lien ranged from 36 days to 233 days. We will assess the impact of IRS’s actions and continue to review IRS’s release of tax liens as part of our fiscal year 2006 audit. For (1) IRS’s AUR and Combined Annual Wage Reporting programs, (2) screening and examination of Earned Income Tax Credit claims, and (3) identifying and collecting previously disbursed improper refunds, use the best available information to develop reliable cost-benefit data to estimate the tax revenue collected by, and the amount of improper refunds returned to, IRS for each dollar spent pursuing these outstanding amounts. These data would include (1) an estimate of the full cost incurred by IRS in performing each of these efforts, including the salaries and benefits of all staff involved, as well as any related nonpersonnel costs, such as supplies and utilities and (2) the actual amount (a) collected on tax amounts assessed and (b) recovered on improper refunds disbursed. (long-term) Internal Revenue Service: Recommendations to Improve Financial and Operational Management (GAO-01-42, Nov. 17, 2000) Open. Allocation methodology was reviewed and enhanced for fiscal year 2006 and further refinements will be implemented each year. The first year’s data will be reviewed in fiscal year 2006 and a plan developed for integrating cost data in decision making. The use of the data will be tested in fiscal year 2007 with baseline data. However, to achieve maximum benefit in decision making, several years’ data will be needed. As a result, the IRS will fully implement the use of cost accounting data for resource allocation decisions in fiscal year 2008. Open. During our fiscal year 2005 audit, IRS provided information on the AUR program, including program results. Based on our review of the information and discussions with IRS officials, we determined IRS does not use the data to make decisions on the AUR workload. In addition, IRS implemented a cost accounting module during fiscal year 2005. However, management has not yet determined what the full range of its cost information needs are or how best to tailor the capabilities of this module to serve those needs. Also, IRS has not yet implemented a related workload management system intended to provide the cost module with detailed personnel cost information. In addition, as noted by IRS, because it generally takes several years of historical cost information to support meaningful estimates and projections, IRS cannot yet rely on this system as a significant planning tool. We will continue to followup on IRS’s progress on this issue during our fiscal year 2006 audit. Develop a subsidiary ledger for leasehold improvements and implement procedures to record leasehold improvement costs as they occur. (long- term) Internal Revenue Service: Recommendations to Improve Financial and Operational Management (GAO-01-42, Nov. 17, 2000) Open. In IFS Release 1, implemented on November 10, 2004, P&E and leasehold improvements are recorded as assets when purchased. However, amortization will remain a manual process. The ability to tie the detailed physical asset information and a fully integrated system with subsidiary records will not be available until the Asset Management module is implemented. At present, all future releases are being reevaluated based on funding availability and no future implementation date has been established. Open. IRS implemented the first release of the new IFS on November 10, 2004, which allowed recording leasehold improvements as assets when purchased. However, implementation of a property asset module that is intended to generate detailed records for P&E that will reconcile to the financial records is being deferred indefinitely due to funding constraints. We will continue to monitor IRS’s progress in implementing subsequent IFS releases and the property asset module. Implement procedures and controls to ensure that expenditures for P&E are charged to the correct accounting codes to provide reliable records for expenditures as a basis of extracting the costs for major systems and leasehold improvements. (short- term) Internal Revenue Service: Recommendations to Improve Financial and Operational Management (GAO-01-42, Nov. 17, 2000) Closed. In IFS Release 1, implemented on November 10, 2004, P&E and leasehold improvements are posted to the correct accounting code at the time of purchase. IRS has improved the definitions of P&E and has provided guidance on appropriate coding classifications to end users. Routine control reviews have been established to ensure the accuracy and appropriate coding of classifications. Closed. IRS implemented the first release of IFS on November 10, 2004, which incorporated procedures to allow IRS to record the majority of P&E additions in the appropriate general ledger accounts as they occur. During our fiscal year 2005 audit, we found that IRS was generally recording P&E transactions as they occurred, although we did identify some new issues. See recommendation ID. No. 06-20. Develop a mechanism to track and report the actual costs associated with reimbursable activities. (long-term) Management Letter: Improvements Needed in IRS’s Accounting Procedures and Internal Controls (GAO-01-880R, July 30, 2001) Open. IRS has developed guidance for costing reimbursable agreements, which includes instructions on tracking labor. IFS Release 1, implemented on November 10, 2004, includes a cost module that will interface with program area management information systems. Full cost accounting will not be realized until future releases, such as Work Management, are implemented. Actions will be initiated in fiscal year 2006 or fiscal year 2007 to begin gathering the real cost of certain reimbursable projects. At present, future releases are being evaluated based on funding availability and no future implementation date has been established. Open. We confirmed that IRS has procedures for costing reimbursable agreements that provide the basic framework for the accumulation of both direct and indirect costs at the necessary level of detail. IRS plans to implement these procedures over several years as it phases in various program area management information systems that will provide critical information to its new cost accounting system. However, as indicated by IRS, these systems have not yet been scheduled for implementation. We will continue to monitor IRS’s efforts to fully implement its cost accounting system and, once it has been fully implemented, evaluate the effectiveness of IRS procedures for developing cost information for its reimbursable agreements. Internal Revenue Service: Progress Made, but Further Actions Needed to Improve Financial Management (GAO-02-35, Oct. 19, 2001) Closed. In IFS Release 1, implemented on November 10, 2004, property and equipment are recorded as assets when purchased. Closed. IRS implemented the first release of IFS on November 10, 2004, which incorporated procedures to allow IRS to record the majority of P&E additions in the appropriate general ledger accounts as they occur. During our fiscal year 2005 audit, we found that IRS was generally recording P&E transactions as they occurred, although we did identify some new issues. See recommendation ID. No. 06-20. Implement policies and procedures to require that all employees itemize on their time cards the time spent on specific projects. (long-term) Internal Revenue Service: Progress Made, but Further Actions Needed to Improve Financial Management (GAO-02-35, Oct. 19, 2001) Open. IRS agreed with the objective of this recommendation, which is to allow it to collect and report the full payroll costs associated with its activities. While IRS indicated that most of its employees already itemize their time charges in functional tracking systems, it has acknowledged that full implementation of the IFS cost accounting module is required to close this recommendation. IFS Release 1, implemented on November 10, 2004, includes requirements for a cost module that will be interfaced with program area management information systems. Both direct and indirect resource cost data can be linked to the budget process and the strategic planning goals of all business units. This will help move IRS forward in transitioning to a performance- based organization. Full cost accounting will not be realized until future releases, such as Work Management, are implemented. At present, all future releases are being reevaluated based on funding availability and no future implementation date has been established. Open. We confirmed that IRS employees continue to use functional tracking (workload management) systems to itemize and track their time charges. However, this recommendation remains open because its objective is to allow IRS to collect and report the full payroll costs associated with its activities. During our fiscal year 2005 audit, we continued to find that the functional tracking systems are insufficient for this purpose because they do not interface with each other or the general ledger to allow management to use them to readily accumulate the time charged to specific projects. Implement policies and procedures to allocate nonpersonnel costs to programs and activities on a routine basis throughout the year. (long-term) Internal Revenue Service: Progress Made, but Further Actions Needed to Improve Financial Management (GAO-02-35, Oct. 19, 2001) Open. The IFS, Release 1, implemented on November 10, 2004, includes a cost module that is interfaced with program area management information systems. Both direct and indirect resource cost data can be linked to the budget process and the strategic planning goals of all business units. This helps move IRS forward in transitioning to a performance-based organization. Full cost accounting will not be realized until future IFS releases, including Work Management, are implemented. Open. We confirmed that the IRS plans include requirements that meet the objectives of this recommendation; however, IRS has indefinitely delayed the implementation of these requirements. IRS’s plans to implement these requirements are expected to be executed over several years as IRS phases in various program area management information systems that will provide critical information to the cost accounting system. We will continue to monitor the progress of IRS’s efforts to address this issue. Develop policies and procedures to require that IRS and lockbox employees performing final candling record receipts in a control log at the time of discovery, recording at a minimum the total number of payments found, the amount of each payment, and the taxpayer who submitted the payment. (short-term) Management Report: Improvements Needed in IRS’s Accounting Procedures and Internal Controls (GAO-02-746R, July 18, 2002) Closed. The 2005 Lockbox Processing Guidelines (LPG), Documentation of Items Found in Candling (Form 9535), directs the responsible manager to initial Form 9535 every day for each shift. An entry must be made each shift, whether or not items have been found. A manager will initial Form 9535 to validate all of the following: (1) all available information is correctly entered; (2) items found have been reconciled with Form 9535 entries; (3) items have been correctly categorized as processable or unprocessable; (4) all processable work has been cleared after each shift, i.e., the work has been put back into the stream of work; and (5) the received date has been entered correctly. Only Form 9535 will be used for documenting items found during candling. Closed. During our fiscal year 2005 audit, we verified that IRS updated its candling procedures in the LPG and IRM to include the recording of receipts in the control log at the time of discovery. IRM 3.10.72.6.2 provides the following guidance for the campuses: Management shall maintain Form 13592 Candling Log – Receipt and Control (R&C) Discovered Remittances to record remittances found in final candling. An employee designated by management will immediately record these items into the final candling log. In addition, management shall initial the log to validate that all available information is correctly entered and ensure that all remittances listed on the log are brought to the deposit function on a daily basis. The National Office redesigned the Form 13592 candling log that records, at a minimum, the total number of payments found, the amount of each payment, and the taxpayer who submitted the payment. Ensure that field office management complies with existing receipt control policies that require a segregation of duties between employees who prepare control logs for walk-in payments and employees who reconcile the control logs to the actual payments. (short- term) Management Report: Improvements Needed in IRS’s Accounting Procedures and Internal Controls (GAO-02-746R, July 18, 2002) Open. Field Assistance has implemented in TACs, where staffing permits, the review of Form 795 and all supporting documents for accuracy by someone other than the recipient of the funds before they are transmitted to the SPCs. Additional procedures are being explored to determine a process for mitigating the circumstances that prevent proper segregation of duties in those TACs with limited staffing. Additional emphasis will be placed on development of internal controls and the oversight and accountability of both employees and managers within Field Assistance. Open. During our fiscal year 2005 audit, we found a lack of segregation of duties related to the preparation, review, and/or reconciliation of Form 795 at six of the eight TACs we visited. At three of these TACs, at times only one employee is present to carry out the functions of the office. At another TAC, there was no evidence that the Form 795 was reconciled by an employee other than the employee who received the payment from the taxpayer and recorded it on the Form 795. At this same TAC, we observed two instances where employees did not log information onto the Form 795 upon receipt. At the fifth TAC, the employee responsible for receiving and recording payments on the control log did not receive an independent reconciliation of the payments before they were mailed to the SCC for further processing. At the sixth TAC, one employee retrieved all the checks from the locked container and logged all the checks received onto a Form 795 and sent them to the SCC without a supervisor or designee review. We will evaluate IRS’s corrective actions during our fiscal year 2006 audit. Management Report: Improvements Needed in IRS’s Accounting Procedures and Internal Controls (GAO-02-746R, July 18, 2002) Closed. In July 2005, NFC demonstrated (first time) a Web version of SETS and more IRS requirements are to be accommodated in that system; a meeting is slated for early 2006 between IRS and NFC. Also, IRS/NFC dialogue continues to ensure that data flows are timely and accurate, reconciliations and error adjustments regularly occur, and monthly NFC reports are reviewed and analyzed by IRS. Agency-Wide Shared Services (AWSS) continues to monitor SETS reports for each pay period and coordinates with employment offices when corrections are needed. IRS and NFC continue to engage on-going discussions on reconciliations and error adjustments as needed. NFC controls the time table for deploying a Web version of SETS; however, no time table has been set and no meetings are being convened. Open. During our fiscal year 2005 audit, we continued to find technical limitations in IRS’s SETS database. The corrective actions cited by IRS were subsequent to our fieldwork for the fiscal year 2005 audit. We will evaluate the effectiveness of these actions during our fiscal year 2006 audit. Lockbox Banks: More Effective Oversight, Stronger Controls, and Further Study of Costs and Benefits Are Needed (GAO-03-299, Jan. 15, 2003) Closed. IRS and the Financial Management Service (FMS) prepared a reimbursement process. The procedures include the use of a special Lockbox Program code to delineate IRS rework costs as a result of errors made by the lockbox sites. The Lockbox Policy Reimbursement procedures are included in the 2005 LPG under LPG 2.1.9 and 2005 Lockbox Processing Procedures under IRM 3.0.230.9.3. Closed. During our fiscal year 2005 audit, we verified that IRS had incorporated reimbursement procedures in the 2005 LPG. Revise the guidance used for compliance reviews so it requires reviewers to (1) determine whether lockbox contractors, such as couriers, have completed and obtained favorable results on IRS fingerprint checks and (2) obtain and review all relevant logs for cash payments and candled items to ensure that all payments are accounted for. (short- term) Lockbox Banks: More Effective Oversight, Stronger Controls, and Further Study of Costs and Benefits Are Needed (GAO-03-299, Jan. 15, 2003) Closed. IRS updated the security check sheet in January 2004 to instruct reviewers to determine whether contractors have completed and obtained favorable fingerprint results and to review all relevant logs for cash payments and candling logs. In order to ensure compliance to the LPG requirements, an IRS and FMS task group developed a performance measures process to include a category for security (Courier, Physical, Remittance) that was implemented in October 2005. This process which was piloted in 2005 and implemented in January 2006 uses a data collection instrument (DCI) check sheet that lists by line item the requirements as outlined in the LPG. It is used as a tool to identify varying levels of performance and provide incentives and disincentives based on those levels of performance. This helps the IRS/FMS Security staff ensure compliance with the LPG requirements. Additionally, an internal control review is included in the reviews performed quarterly by the Lockbox coordinators. Closed. During our fiscal year 2005 audit, we verified the lockbox coordinator’s on-site review check sheet included the requirement to ensure that the cash and candling logs are being kept and updated daily and that contractors have completed and obtained favorable results on IRS fingerprint checks. Assign individuals, other than the lockbox coordinators, responsibility for completing on-site performance reviews. (short-term) Lockbox Banks: More Effective Oversight, Stronger Controls, and Further Study of Costs and Benefits Are Needed (GAO-03-299, Jan. 15, 2003) Closed. IRS Lockbox Field Section, IRS Policy & Procedures Section, and FMS are responsible for conducting their own on-site performance reviews during peak season at each Lockbox site. DCIs are used by the IRS Field Coordinators to review Lockbox processing requirements and processing internal controls. DCIs are also used by IRS Policy & Procedures Section in conjunction with IRS Mission Assurance and FMS Security to review courier, physical, and personnel security. FMS and IRS Policy and Procedures Section also use a check sheet to review various processing/security requirements during peak processing. DCI processing reviews are also completed daily at each IRS SPC by SPC staff after the work is received from the lockbox. The on-site DCI processing and security reviews and the SPC reviews are incorporated into the Bank Performance Standards scorecards. The scorecards are signed by both IRS and FMS management prior to being issued to each Lockbox site under an FMS cover letter. In addition, peak trip reports are completed jointly by the IRS and FMS personnel on site. These trip reports assess the banks performance by categories such as deliverables, FMS cash management cash flow, mail, processing, remittance security, and staffing. This report is used to capture any observations that may or may not have been covered on the various DCIs. The combination of these reviews serves as the checks and balances of the program. While the Field Coordinators remain responsible for the on-site processing review, these reviews constitute only a portion of the overall assessment of each lockbox site. Closed. We issued this recommendation in January 2003 when the lockbox coordinators were the only individuals responsible for conducting the performance reviews and at that time these reviews were not being performed because of competing demands. Over the years, IRS and FMS have increased their oversight of the lockbox bank program with various performance and compliance reviews. These reviews include peak season trip reports and annual security reviews conducted jointly by IRS and FMS staff. In addition, IRS has implemented a scorecard system performed, reviewed, and signed by both IRS and FMS that incorporates the results of the reviews. These procedures collectively satisfy the objective of this recommendation. Lockbox Banks: More Effective Oversight, Stronger Controls, and Further Study of Costs and Benefits Are Needed (GAO-03-299, Jan. 15, 2003) Closed. To provide more emphasis on security, the Lockbox Security Guidelines (LSG) is no longer included in the LPG. Beginning in 2006 LSG is a separate document. LSG 2.2.2.4(7) requires that “Bank management is ultimately responsible for access control and procedures for ensuring only authorized personnel are granted access to the processing floor. Bank management must be involved in the day to day access control process. This responsibility cannot be delegated (e.g., to temporary agency personnel, security guards, third parties).” LSG 2.2.3.1 (7) provides the requirements for guards to respond to alarms. The Security Team performs alarm testing and evaluates guards’ responses to alarms during their on-site security reviews. Security Performance Measures (effective January 2006) were developed to measure and rate each site’s overall adherence to security guidelines and provides incentives/disincentives accordingly. Mission Assurance and FMS Security staff supports the Lockbox Policy and Procedures Program Office in conducting security reviews. Reviews rate each site’s compliance to physical, personnel, courier, and information technology (IT) security. Closed. We verified that the LSG requires lockbox bank management to ensure that guards are responsive to alarms. Additionally, we verified that Security Performance Measures are in place to measure and rate each lockbox bank’s overall adherence to security guidelines. Require lockbox management to ensure that envelopes are properly candled and that IRS take steps to monitor adherence to this requirement. (short- term) Lockbox Banks: More Effective Oversight, Stronger Controls, and Further Study of Costs and Benefits Are Needed (GAO-03-299, Jan. 15, 2003) Closed. Effective October 2005, candling reviews are conducted at all Lockbox sites to ensure that all candling requirements are being met. These internal control reviews ensure that envelopes opened (manually or by OPEX) on three or more sides are candled once and that envelopes other than the ones opened on three or more sides are candled twice. The results of these reviews are used to calculate each bank’s score in the new bank performance measurement process. The Processing-Internal Controls (PIC) DCI that included the new candling review was first performed by Lockbox Field Coordinators at Individual Master File (IMF) lockbox sites during on- site reviews in October 2005 and at Business Master File (BMF) sites in November 2005. This element is now part of the Lockbox Performance Scorecard Measures. Open. During our fiscal year 2005 audit, we found instances at one lockbox bank where employees did not properly candle envelopes. However, the candling reviews planned by IRS were implemented subsequent to the completion of our fiscal year 2005 fieldwork. We will evaluate the effectiveness of these reviews during our fiscal year 2006 audit. Lockbox Banks: More Effective Oversight, Stronger Controls, and Further Study of Costs and Benefits Are Needed (GAO-03-299, Jan. 15, 2003) Closed. The requirement to ensure that returned refund checks are restrictively endorsed immediately upon extraction was previously listed in Section 3.2.1 of the 2002 LPG issued January 1, 2002, as well as the 2003 (revised April 8, 2003) and 2004 LPG, issued December 1, 2003. During the on-site security reviews, IRS and FMS security teams reviewed adherence to this requirement. Additionally, adherence to this requirement is evaluated during the daily SPC quality reviews. Closed. During our fiscal year 2005 audit, we did not identify any instances where returned refund checks at the lockbox banks were not restrictively endorsed upon extraction. Confirm with FMS that IRS’s requirements for background and fingerprint checks for courier services are met regardless of whether IRS or FMS negotiates the service agreement. (short- term) Management Report: Improvements Needed in IRS’s Internal Controls (GAO-03-562R, May 20, 2003) Open. IRS’s IRM and lockbox bank policies require that all courier employees satisfy requirements for background and fingerprint checks regardless of who negotiated the courier service agreement. However, when we updated our review of courier contracts in March 2006, we again found that one FMS- negotiated contract did not contain IRS’s requirements for background and fingerprint checks for courier services. We will continue to evaluate the compliance of the 2006 courier agreements during our fiscal year 2006 audit. depositories. Courier policies and procedures were reinforced in IRM 3.8.45 with FRB and TGA bank offices and campus deposit managers. The NBIC program manager participated in this session. Prohibit the storage of employees’ personal belongings with cash payments and receipts at IRS’s taxpayer assistance centers. (short-term) Management Report: Improvements Needed in IRS’s Internal Controls (GAO-03-562R, May 20, 2003) Closed. In 2005, remittance training covering the procedures for remittance processing was conducted for all TAC managers. The requirement prohibiting storing personal belongings with taxpayer data was reiterated. Operational reviews are planned by Field Assistance Headquarters to ensure TACs adhere to required IRM procedures. Additional emphasis will be placed on development of internal controls and the oversight and accountability of both employees and managers within Field Assistance. Open. During our fiscal year 2005 audit, we identified an instance at one TAC where an employee’s personal belongings were stored with taxpayer receipts. In addition, IRS’s response does not specifically address the prohibition of taxpayer payments (cash and non-cash) with employees’ personal belongings as stated in our recommendation. We will continue to evaluate IRS’s corrective actions during our fiscal year 2006 audit. Revise its candling procedures to specify the precise candling methods to be used based on the dimensions of the mail processed and the extraction method used for both the first and the final candling. (short-term) Management Report: Improvements Needed in IRS’s Internal Controls (GAO-03-562R, May 20, 2003) Closed. Additional guidance was issued to Submission Processing field employees on February 28, 2005, reinforcing the importance of ensuring Submission Processing candling procedures and policies are followed. IRM 3.10.72 has been revised to specify precise candling methods, as well as specific illumination measures of light. In addition, new requirements were implemented to turn large envelopes that cannot be easily opened on all three sides, inside out. This requirement is part of the campus monthly security reviews. All findings are shared with SP field directors. Local management continues to remind employees of the importance of candling of envelopes on a regular basis through individual and group meetings to ensure compliance with this requirement. Closed. We verified that the IRM has been updated to provide specific instructions regarding the candling processes for different types of mail processed by service center campuses. Establish and implement procedures prohibiting a single employee from performing the final candling in a remote location. (short-term) Management Report: Improvements Needed in IRS’s Internal Controls (GAO-03-562R, May 20, 2003) Closed. IRM 3.10.72 has procedures prohibiting a single employee from performing the final candling in a remote location. This requirement is part of the campus monthly security reviews. All findings are shared with SP field directors. Local management continues to remind employees of candling requirements through individual and group meetings to ensure compliance with this requirement. Closed. We verified that IRS had established and implemented procedures prohibiting a single employee from performing final candling in a remote location. In addition, we did not identify any instances in which final candling were performed by only one individual. Management Report: Improvements Needed in Controls over IRS’s Excise Tax Certification Process (GAO-03- 687R, July 23, 2003) Closed. An MOU was signed December 15, 2004, by the Chairman, Excise Tax Trust Fund Working Group. The IRS Treasury Excise Tax Trust Fund Working Group MOU established a process of recording minutes of the Working Group meetings in order to document issues related to trust fund certification procedures/ processes and proposed or passed legislative changes impacting trust fund investments. Recording of minutes will be taken by a representative of Treasury member offices or bureaus on a rotating basis. Draft minutes will be shared with all participants for concurrence prior to final approval and distribution. IRS will discuss and make a presentation to advise the members of any changes to the trust fund certification process. Closed. We verified that the Treasury Excise Tax Trust Fund Working Group signed a resolution to establish a process for documenting issues related to IRS’s trust fund certifications. Our review shows the Treasury Excise Tax Working Group has established a process of recording and distributing minutes of the Working Group meetings in order to document issues related to trust fund certification procedures/ processes including procedural or legislative changes impacting trust fund investments. Require lockbox bank managers to maintain appropriate documentation on-site demonstrating that satisfactory fingerprint results have been received before contractors are granted access to taxpayer receipts and data. (short-term) Management Report: Improvements Needed in IRS’s Internal Controls and Accounting Procedures (GAO-04-553R, Apr. 26, 2004) Closed. To provide more emphasis on security, LSG (2.5) requires appropriate documentation for couriers and guards before they are granted access to taxpayer receipts. To ensure compliance with the LSG, IRS/FMS Security has included this as a review item during their security reviews. Closed. We verified that the LSG does include a requirement that lockbox managers maintain documentation on-site demonstrating that satisfactory fingerprint results have been received before contractors are granted access to taxpayer receipts and data. During our fiscal year 2005 audit, we did not identify any instances in which contractors were granted access to taxpayer receipts and data without having satisfactory fingerprint results on file at the lockbox banks that we visited. Management Report: Improvements Needed in IRS’s Internal Controls and Accounting Procedures (GAO-04-553R, Apr. 26, 2004) Closed. On February 14, 2005, the 2005 LPG was updated and reinforced current courier requirements with an addendum entitled “Courier’s Additional Disclosure Statement.” Each courier is required to complete and sign the disclosure, affirming that they are not to travel with an immediate family member. In addition, each courier is required to list the name and relationship of each family member residing in the same domicile that also performs courier duties for the IRS. The disclosure statement is updated annually and maintained in the personnel file. Starting in July 2005, during the onsite reviews, the IRS/FMS Security Team began reviewing the disclosure statements to ensure adherence to this requirement. Closed. We confirmed that IRS updated its policy on two-person courier teams for lockbox banks as reflected in the revised LPG. Additionally, we identified no instances in which two-person courier teams consisted of closely related individuals during our fiscal year 2005 testing at the four lockbox banks and four service center campuses that we visited. Management Report: Improvements Needed in IRS’s Internal Controls and Accounting Procedures (GAO-04-553R, Apr. 26, 2004) Closed. Effective October 1, 2005, IRS established a new DCI review entitled “Processing-Internal Controls.” During on-site reviews, the following logs are required to be reviewed: desk and work area, date stamp, cash, candling, shred, and mail. The results of these DCI reviews are rolled into a calculation to determine each bank’s score in the new bank performance measurement process. In addition, lockbox personnel are required to perform reviews of the desk and work area, cash, candling, and shred logs. A monthly report for each review must be sent to the Lockbox Field Coordinator on the fifth business day of the month following the review. The report must contain the following: date of review, shifts reviewed, results of the review (even when no items are found), and reviewer’s and site manager’s initials and/or signature as required by the LPG. To further strengthen this internal control, effective June 1, 2006, additional review of the monthly reports (F9535/Discovered Remittance, candling log, disk checks/audits, and shred) received from the lockbox site will be performed by the Lockbox Field Coordinators. Specific check points will be added to the “Monthly Reports” DCI that is a part of the Procedural DCI performed at the SPC. In addition to confirming the receipt and timeliness of the reports, coordinators will review the reports to ensure they are completed per the LPG requirements and that all required management signatures/initials are present to provide satisfactory evidence that the managerial reviews are performed. Open. During our fiscal year 2005 audit, we verified that the LPG and LSG instruct the lockbox bank managers to perform numerous managerial reviews and to provide evidence that the reviews were performed. However, at two of the four lockbox banks we visited, we found that satisfactory evidence was not always provided to validate that these reviews were performed in accordance with established guidelines. In addition, IRS’s corrective actions addressing documentation of required reviews occurred subsequent to our fiscal year 2005 fieldwork. We will evaluate IRS’s corrective actions during our fiscal year 2006 audit. Revise candling procedures at lockbox banks to require testing of automated candling machines at appropriate intervals, taking into account factors such as use time, volume processed, machine requirements and shift cycles. (short-term) Management Report: Improvements Needed in IRS’s Internal Controls and Accounting Procedures (GAO-04-553R, Apr. 26, 2004) Closed. Lockbox Policy and Procedures staff assessed the candling procedures and determined that current technologies are not exempt from the candling requirement and added to the 2005 LPG section 3.2.8(1) that envelopes opened (either manually or by OPEX equipment) on three or more sides must be candled once on the candling tables. Thus, the requirement to keep tests and logs is not necessary. All other envelopes must be candled twice on the candling tables. Closed. During our fiscal year 2005 audit, we verified that the LPG requires that envelopes opened (either manually or by OPEX equipment) on three or more sides must be candled one additional time on the candling table. This change and IRS’s assessment that current technologies are not exempt from the two candling requirement satisfies the objective of our recommendation. Management Report: Improvements Needed in IRS’s Internal Controls and Accounting Procedures (GAO-04-553R, Apr. 26, 2004) Closed. Lockbox Policy and Procedures staff assessed the candling procedures and determined that current technologies are not exempt from the candling requirement and added to the 2005 LPG section 3.2.8(1) that envelopes opened (either manually or by OPEX equipment) on three or more sides must be candled once on the candling tables. Thus, the requirement to keep tests and logs is not necessary. All other envelopes must be candled twice on the candling tables. Closed. During our fiscal year 2005 audit, we verified that the LPG requires that envelopes opened (either manually or by OPEX equipment) on three or more sides must be candled one additional time on the candling table. This change and IRS’s assessment that current technologies are not exempt from the two candling requirement satisfies the objective of our recommendation. Management Report: Improvements Needed in IRS’s Internal Controls and Accounting Procedures (GAO-04-553R, Apr. 26, 2004) Closed. In 2003, IRM 3.8.46, Discovered Remittances, was issued and 10,000 copies were distributed to all campuses. Form 4287 (Record of Discovered Remittances) was revised to enhance adherence to existing instructions by including a check box for managers to indicate the reconciliation was performed. Additionally, Submission Processing revised the monthly security checklist to include a review of the discovered remittance procedures. A Discovered Remittances Job Aid was added to IRM 3.8.46 on January 26, 2005 via the SP Web site. The job aid and a PowerPoint presentation were added to the SP Web site again in August 2005. Open. We verified that the IRM contains a discovered remittances job aid to be used for recording discovered remittances. However, during our fiscal year 2005 audit we found that two of the four SCCs we visited did not adhere to the IRM procedures for securing discovered remittances. We will evaluate IRS’s corrective actions during our fiscal year 2006 audit. Management Report: Improvements Needed in IRS’s Internal Controls and Accounting Procedures (GAO-04-553R, Apr. 26, 2004) Open. Mission Assurance revised policies and procedures in IRM 1.16.12, to require the following: (1) self-assessments which test response capabilities of guards to alarms. Mission Assurance implemented a self-assessment tool in October 2004 which is used to test response capabilities relating to alarm activation; (2) monthly, unannounced alarm tests at all campuses and computing centers; (3) mandatory reporting of the monthly alarm test results to the office of Physical Security and Emergency Preparedness (PSEP); (4) review of the monthly test results by the PSEP office, ensuring that the results are in compliance with IRM requirements, and if not, providing feedback for improvements; and (5) annual security exercises at each facility to test alarm responses. Open. During our fiscal year 2005 audit, we continued to find weaknesses in IRS’s enforcement of policies and procedures to ensure that SCC security guards respond to alarms. We identified instances at two of four SCCs visited during our fiscal year 2005 audit in which guards either did not respond or did not respond timely to our tests of door alarms. IRS’s implementation of new procedures to address guard response issues occurred subsequent to the end of our fiscal year 2005 audit fieldwork. We will evaluate IRS’s corrective actions during our fiscal year 2006 audit. Establish compensating controls in the event that automated security systems malfunction, such as notifying guards and managers of the malfunction, and immediately deploying guards to better protect the processing center’s perimeter. (short-term) Management Report: Improvements Needed in IRS’s Internal Controls and Accounting Procedures (GAO-04-553R, Apr. 26, 2004) Closed. Mission Assurance developed alarm testing procedures which are used to supplement the requirements in IRM 1.16.12. The IRM and supplemental procedures require the notification of local management whenever there is a malfunction of alarms. The procedures also require that guards are deployed or doors are secured, as necessary, either during tests or when otherwise identified. The contract guard force project manager is required to sign off on all unannounced alarm test reports. Test results are maintained by the PSEP office. Open. IRS indicates in its response that compensating controls have been developed and implemented in the event that automated security systems malfunction. However, from our review of the IRM and the compensating controls used in conjunction with the IRM, we did not identify any procedures outlining specific controls to be employed should automated security systems malfunction or be taken out of service for any period of time. We will evaluate IRS’s corrective actions during our fiscal year 2006 audit. Until the Business Performance Management System (BPMS) is fully operational, implement procedures to ensure that all performance data reported in the MSP report are subject to effective, documented reviews to provide reasonable assurance that the data are current at interim periods. (short-term) Management Report: Improvements Needed in IRS’s Internal Controls and Accounting Procedures (GAO-04-553R, Apr. 26, 2004) Closed. IRS has taken steps to ensure that the performance measures data reported in the monthly report are properly reviewed before being published. All divisions now submit most of their performance measures data directly to BPMS. The divisions are required to verify/certify the accuracy of the data before uploading to BPMS. Corporate Performance Budgeting staff implemented additional manual quality control procedures that include reviewing all tables, charts, and line graphs and visually inspecting the numbers and comparing the information to the previous month’s report for consistency. In addition, IRS is working with Treasury to streamline its current set of performance measures. Its purpose is to increase the value of the information provided to stakeholders, focus priorities, and reduce administrative burden. Open. In fiscal year 2005, we continued to find errors in IRS’s interim performance measures data at interim periods. GAO will continue to monitor IRS’s progress in this area during our fiscal year 2006 financial audit. Expedite efforts to resolve the backlog of unpostable liens, releasing liens as appropriate. (short- term) Opportunities to Improve Timeliness of IRS Lien Releases (GAO-05- 26R, Jan. 10, 2005) Closed. IRS conducted a review of the unpostable accounts during the period, October 31, 2005, to November 4, 2005. The remaining 1,500 accounts were resolved by May 31, 2005. Inventories are current and being resolved in a timely manner. Closed. We verified that IRS had resolved the backlog of unpostable liens. IRS’s Centralized Case Processing/ Lien Processing Unit at the Cincinnati Campus is researching and resolving unpostable liens weekly. We reviewed IRS’s report of unpostable liens from February and March 2006 and determined there was no current backlog. Keep current on all new unpostable liens. (short-term) Opportunities to Improve Timeliness of IRS Lien Releases (GAO-05- 26R, Jan. 10, 2005) Closed. IRS has been resolving new unpostables within 5 days since June 2004. IRS conducted a review of the unpostable accounts during the period, October 31, 2005, to November 4, 2005, which verified inventories are current and being resolved in a timely manner. Closed. Although IRS has not formally documented procedures in the IRM for weekly resolution of unpostable liens, IRS officials of the Centralized Case Processing / Lien Processing Unit told us that they research and resolve unpostable liens weekly. We reviewed six weekly reports of unpostable liens from February through March 2006 and determined that IRS was keeping current on new unpostable liens. Research and resolve the current backlog of unresolved unmatched exception reports. (short-term) Opportunities to Improve Timeliness of IRS Lien Releases (GAO-05- 26R, Jan. 10, 2005) Open. Managers and employees have received training on the entity portion of the Satisfied Module (SATMOD) Reject Report. Resolution of the backlog will be conducted by the centralized site. Anticipated time for resolution is being extended to May 2006 in order to complete a workshop, compile the extract from the master file, and establish a specific group of employees to work on the backlog. Open. We will review the status of IRS’s corrective actions as part of our fiscal year 2006 audit. Research and resolve unmatched exception reports weekly. (short- term) Opportunities to Improve Timeliness of IRS Lien Releases (GAO-05- 26R, Jan. 10, 2005) Open. IRS developed new procedures for working on the unmatched exception reports. Accounts on the unmatched exception report will be resolved by matching information between the master file and the Automated Lien System (ALS). Timely report resolution is an integral function of the Centralized Lien Unit, and time frames and managerial oversight are built into report resolution processes. Managers and employees have received training on the entity portion of the reject report. Training will be ongoing as new employees are assigned to the unit. IRM provisions require resolution of rejected accounts within 5 business days. Managers will monitor timeliness and will report weekly on the outstanding inventory. SB/SE has started working on the cumulative listings; however, additional time is needed to complete the listings. Collection Policy will conduct an onsite review in fiscal year 2006. Open. According to IRS officials we contacted in March 2006, IRS anticipates completing this review in June 2006. We will continue to review the results of IRS’s quality review as part of our fiscal year 2006 audit. Opportunities to Improve Timeliness of IRS Lien Releases (GAO-05- 26R, Jan. 10, 2005) Closed. Managers and employees have received training on the resolution of the restricted interest portion of the SATMOD reject report. IRS conducted a review during the period October 31, 2005, to November 4, 2005. All current employees have received training. Procedural changes are not required. Closed. We verified that IRS had provided training to designated staff on resolving exception reports. Research and resolve the current backlog of unresolved manual interest or penalties reports. (short-term) Opportunities to Improve Timeliness of IRS Lien Releases (GAO-05- 26R, Jan. 10, 2005) Open. Managers and employees have received training on the resolution of the manual computation portion of the reject report. IRM provisions require resolution of the rejected accounts within 5 business days. Managers will monitor timeliness and will report weekly on the outstanding inventory. The Collection Policy unit will conduct an on-site review. Training will be given to all new employees as they are assigned to the group. The revised anticipated completion date is May 2006. Open. According to IRS officials we contacted in March 2006, IRS anticipates completing this action in May 2006. We will continue to monitor IRS’s efforts to address its backlog of exception reports containing liens with manually calculated interest or penalties as part of our fiscal year 2006 audit. Research and resolve exception reports containing liens with manually calculated interest or penalties weekly, as called for in the IRM and the ALS User Guide. (short-term) Opportunities to Improve Timeliness of IRS Lien Releases (GAO-05- 26R, Jan. 10, 2005) Closed. ALS receives a master file data extract listing modules where liabilities have been fully paid. The data extract that is matched against information in the ALS automatically releases liens when there is a match. In the case of modules with restricted interest or penalty, the module is placed on a report for manual processing. In our review of 300 satisfied modules, we identified five cases with additional restricted interest or penalties. The remaining amounts due after computation were for very small amounts, less than $10. Based on those reviews, we ascertained that these cases should receive systemic release based on the status 12 information provided by master file and verified by our review. Copies of the last four weekly extract transmittals in March were reviewed to verify that there were no restricted interest and penalty entries on the listing—confirming that these cases have been systemically released. Open. According to IRS, an internal study determined that the dollar amounts of additional interest and penalties to be assessed on cases with liens requiring manual calculations was not significant. Consequently, IRS is in the process of revising the IRM to no longer require the additional manual computation and assessment of interest and penalties on such cases. In addition, IRS updated its computer programs to automatically release liens once the current account balance had been satisfied. IRS’s actions are based on its determination that the additional interest and penalty amounts are not significant. We will review the results of IRS’s internal analysis during our fiscal year 2006 audit. Provide training to designated staff on how to resolve exception reports containing accounts with manually calculated interest or penalties. (short-term) Opportunities to Improve Timeliness of IRS Lien Releases (GAO-05- 26R, Jan. 10, 2005) Closed. IRS conducted workshops and provided training to employees of the Centralized Case Processing Lien Teams. IRS conducted an onsite review during the period, October 31, 2005, to November 4, 2005. Procedural changes are not required. Closed. IRS created a special unit within the Centralized Case Processing Lien Processing Unit at the Cincinnati Campus to resolve accounts containing restricted interest and penalties. We verified that IRS had provided training to staff in this unit for resolving exception reports containing accounts with manually calculated interest and penalties. Unit staff we interviewed understood these procedures. Opportunities to Improve Timeliness of IRS Lien Releases (GAO-05- 26R, Jan. 10, 2005) Open. Requests for additional enhancements to cumulate the reject report have been initiated. In the interim, area managers are required to print and resolve reports based on IRM procedures. Anticipated date of completion is January 2007. Open. We will review IRS’s corrective actions during future audits. Revise the Accounts Management Mail Unit procedures, scheduled to be incorporated into the IRM, to include detailed instructions for (1) monitoring transshipped documents and (2) handling cash receipts found during extraction. Where adequate guidance exists elsewhere, IRS should include these through cross- references. (short- term) Management Report: Review of Controls over Safeguarding Taxpayer Receipts and Information at the Brookhaven Service Center Campus (GAO-05- 319R, Mar. 10, 2005) Closed. IRM 3.10.72.12 and 3.10.203 were updated to include detailed procedures for mail operations where Submission Processing no longer has a presence. These instructions include monitoring transshipped documents, safeguarding taxpayer receipts and information, precise candling, and security requirements. The IRM also contains a cross-reference to the handling of cash receipts. Closed. During our fiscal year 2005 audit, we verified that IRS updated the IRM to include detailed procedures and cross- references, where applicable, for mail operations for SCCs selected for significant reductions in their submission processing functions. Management Report: Review of Controls over Safeguarding Taxpayer Receipts and Information at the Brookhaven Service Center Campus (GAO-05- 319R, Mar. 10, 2005) Closed. IRS has enforced adherence to existing instructions on safeguarding taxpayer receipts and information by including this requirement in the monthly Campus Security Reviews. It is also reviewed annually by the National Office Security Review Team at selected sites. Local Management continually reinforces these requirements through employee counseling and individual and group meetings with security clerks to ensure procedures for issuance of badges, inventory of badges, and security of taxpayer receipts and information. Meetings have also been held to discuss candling procedures. Local management also conducts weekly and monthly reviews to ensure adherence to these procedures. Open. IRS’s corrective actions addressing enforcing adherence to instructions on safeguarding receipts and information occurred subsequent to our fiscal year 2005 fieldwork and will continue as future SCCs are selected for significant reductions in their submission processing functions. We will continue to evaluate IRS’s corrective actions during our fiscal year 2006 audit. Document a methodology for estimating anticipated rapid changes in mail volume at future SCCs selected for significant reductions in their submission processing functions, taking into consideration factors such as the prior rampdown experience at Brookhaven. (short- term) Management Report: Review of Controls over Safeguarding Taxpayer Receipts and Information at the Brookhaven Service Center Campus (GAO-05- 319R, Mar. 10, 2005) Open. IRS will use historical data obtained from the Brookhaven Campus rampdown, and any other prior consolidations, to develop and document a methodology for estimating future mail volumes. This methodology will be used in future consolidations to ensure that IRS has reliable data to effectively manage resources during and after the consolidation period. Open. We will evaluate IRS’s efforts to develop and document a methodology for estimating mail volume for future sites selected for rampdown. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr. 27, 2005) Closed. IRS has implemented steps to monitor and enforce the requirements issued on September 29, 2003, on the issuance of ID cards to contractors. This guidance requires that a letter from the NBIC indicating successful completion of at least an interim background investigation be received by the issuing office before a contractor can be approved for staff-like access to IRS. The guidance further stipulates that Physical Security staff would, at least every 6 months, ensure that a re- certification had been received from the contracting officer’s technical representative (COTR) confirming the contractors’ need for continued staff-like access to the IRS facility. Additionally, as part of the required records and accountability process, non- federal photo ID cards are audited annually by the issuing office to reconcile numerical and alphabetical files and ensure that ID cards have been recovered upon separation or termination of the contract. Open. IRS indicated that steps were taken in September 2003 to monitor and enforce the requirement that appropriate background investigations be completed for contractors before they are granted staff-like access to service centers. However, our recommendation was based on findings from our fiscal year 2004 audit, which occurred subsequent to the issuance of IRS’s guidance. As such, IRS’s actions are not sufficient to address the objective of this recommendation. We will continue to evaluate IRS’s enforcement, oversight, and implementation of contractor background investigation policies during our fiscal year 2006 audit. Require that background investigation results for contractors (or evidence thereof) be on file where necessary, including at contractor worksites and security offices responsible for controlling access to sites containing taxpayer receipts and information. (short- term) Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr. 27, 2005) Closed. A Mission Assurance policy memorandum dated September 29, 2003, requires the COTRs to complete and submit a request form for every contract employee. Implementation of the standardized form assures that all required information is provided in order for the contractor to receive its IRS photo ID card. The guidance requires a copy of the letter from NBIC indicating successful completion of at least an interim background investigation be attached to the request form or no ID card will be issued. Both documents are maintained by the issuing office. Open. IRS’s policies and procedures do not require that documentation of the results of background checks for contractors be maintained onsite at SCCs where contractors are allowed access to sites containing taxpayer receipts and information. During our fiscal year 2005 audit, we found that one SCC did not always maintain this information onsite. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr. 27, 2005) Closed. IRS updated LPG 4.2.3.1, Courier Contingency Plan, on January 1, 2005, to require that prior to implementation of the contract, the courier service must provide the lockbox with a disaster contingency plan. The contingency plan must cover labor disputes, employee strikes, inclement weather, natural disasters, traffic accidents, and unforeseen events. Closed. During our fiscal year 2005 audit, we verified that IRS updated the LPG to require that courier service contractors must provide the lockbox bank with a disaster contingency plan. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr. 27, 2005) Closed. Contingency plans were provided by all lockbox sites by March 31, 2005, and were part of the Filing Season Readiness (FSR) Plan. LPG 4.2.3.1 states “the contingency plan must cover labor disputes, employee strikes, inclement weather, natural disasters, traffic accidents, and unforeseen events.” The lockbox coordinators reviewed the contingency plans to ensure that these issues were addressed. The lockbox coordinators interpreted the contingency plans to be complete; for example, the coordinators may have viewed contingencies covering natural disasters as sufficient to address inclement weather even though the term “inclement weather” was not specifically stated in the plan. GAO disagreed, citing continued areas of deficiencies. In September 2005, the FMS/IRS Security Team conducted an additional review of each site’s courier contingency plans to ensure compliance. Their review indicated that in order to increase consistency and ensure the plans are clearly documented, strengthening of the contingency plan requirements was necessary. The 2006 LSG 2.7 (1) and (2) includes clarification of the requirements for the courier contingency plans. Review of the contingency plans to ensure incorporation of all of the requirements is now assigned to the IRS/FMS security team as part of the on-site courier contingency review. Closed. We verified that IRS and FMS jointly reviewed the lockbox bank courier contingency plans and as a result included language in the LSG clarifying that before courier contracts are implemented, couriers must provide a disaster contingency plan to the lockbox bank addressing specific contingencies. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr. 27, 2005) Closed. LPG 4.2.3.1(1) was updated June 30, 2005, to state that all banks must maintain a signed copy of the courier contingency plan on-site. Closed. During our fiscal year 2005 audit, we verified that IRS revised the LPG to specify that courier contingency plans be available at lockbox banks. Review lockbox bank courier and shredding contracts to ensure that they address all privacy-related criteria and include clear reference to privacy- related laws and regulations. (short- term) Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr. 27, 2005) Closed. The LPG 4.2.3(2), was updated on January 1, 2005— Courier Services—which requires lockbox banks to ensure all bonded courier/armored car agreements address all privacy- related criteria and include clear reference to privacy-related laws and regulations. Effective January 1, 2006, in addition to the above requirement, the LSG.2.17.6 (2)(a) added the requirement that all lockbox banks ensure shred company contracts contain clear reference to the privacy-related laws and regulations. In October 2005 the Lockbox Policy and Procedures team reviewed and confirmed that all courier and shred contracts contained all privacy related criteria. Banks must submit their contracts to the Lockbox Policy and Procedures team for their review by October 1 of each year. The courier contract is also reviewed by the IRS/FMS security staff during the on-site courier security review. Closed. During our fiscal year 2005 audit, we verified that the courier and shredding contracts had the required privacy-related language and related provisions set forth in the Privacy Act of 1974. In addition, we verified that the LSG requires lockbox banks to ensure that all bonded courier agreements contain privacy- related language and reminds couriers of their responsibility to not disclose taxpayer information. Revise the LPG to require that (1) lockbox couriers promptly return deposit receipts to the lockbox banks following delivery of taxpayer remittances to depositories and, (2) lockbox banks promptly review the returned deposit receipts. (short-term) Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr. 27, 2005) Closed. IRS Lockbox Policy and Procedures Section updated the LPG on January 1, 2005—LPG 4.2.3.1.8, Receipt for Transport of IRS Lockbox Bank Deposit Form —which requires the lockbox site to receive back by the next business day the original completed Receipt for Transport of IRS Lockbox Bank Deposit Form with the bank representative’s name and signature, date and time the deposit was received by the depository; and each day the lockbox site must reconcile the Receipt for Transport of IRS Lockbox Bank Deposit Form(s) to ensure receipt of dedicated service (e.g., the time between release to the courier and the release to the bank is not in excess). If discrepancies are found, the lockbox field coordinator should be notified immediately. Closed. During our fiscal year 2005 audit, we verified that IRS updated the LPG to require that (1) lockbox couriers return, on the next business day, deposit receipts to the lockbox banks following delivery of the taxpayer remittances to depositories and (2) lockbox banks promptly review, on a daily basis, the returned deposit receipts. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr. 27, 2005) Closed. The LPG was updated on January 1, 2005—LPG 4.2.3.1.8, Receipt for Transport of IRS Lockbox Bank Deposit Form—to require the courier service employee to return the form to the lockbox site on the next business day, ensuring the following information is completed on the form: the depository bank employee’s name and signature, the date the deposit was received by the depository, and the time the deposit was received by the depository. Closed. During our fiscal year 2005 audit, we verified that IRS updated the LPG to require that deposit receipts for taxpayer remittances include the time and date of receipt by the depository institution. Better enforce the LPG requirement that lockbox bank couriers annotate the time of delivery on receipts for deposits of taxpayer remittances. (short-term) Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr. 27, 2005) Closed. LPG 4.2.3.1.8, Receipt for Transport of IRS Lockbox Bank Deposit Form, was updated on January 1, 2005, to require lockbox bank couriers to annotate the time of delivery of receipts for deposits of taxpayer remittances. New Security Performance Measures have been developed to measure and rate each site’s overall adherence to security guidelines and provides incentives/disincentives accordingly. Mission Assurance and FMS Security support the Lockbox Policy and Procedures Program Office in conducting security reviews. Reviews will rate each site’s compliance to physical, personnel, courier, and IT security. Security Performance Measures is scheduled to be fully implemented by January 2006. To further prepare for filing season each year, each bank is now required to certify that they are adhering to security guidelines. Closed. During our fiscal year 2005 audit, we verified that IRS updated the LPG to require that couriers annotate the time of delivery of receipts for deposits of taxpayer remittances. We did not find any instances during our fiscal year 2005 testing in which the courier did not annotate the time the courier received the deposit from the bank personnel. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr. 27, 2005) Closed. Effective January 1, 2006, the lockbox banks must provide an annual memorandum to the courier contractor reminding them that they must adhere to all of the courier service procedures in the LSG. For the campuses, Service Center Accounting held a conference (Deposit Manager’s CPE on January 31, 2006) with FMS, the Federal Reserve Banks, and the servicing TGA banks and reinforced all policies and procedures governing the courier process as outlined in IRM 3.8.45. Open. We verified that IRS’s LSG requires lockbox banks to issue an annual memorandum to courier contractors reminding them to adhere to all courier service procedures in the LSG. However, this memorandum had not been issued by the conclusion of our fiscal year 2005 fieldwork. We will evaluate IRS’s corrective actions during our fiscal year 2006 audit. Periodically verify that contractors entrusted with taxpayer receipts and information off site adhere to IRS procedures. (short- term) Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr. 27, 2005) Closed. The Lockbox LSG requires that while transporting the data from the lockbox facility, the courier vehicle used to transport taxpayer data/remittances must be locked and secured (LSG 2.13), driven directly to the destination (LSG 2.12) and the vehicle must always be under the supervision of the courier (LSG 2.13). All couriers are required to complete the same National Agency Check and Inquiry with Credit Investigation (NACIC) as bank management officials. For specific transport activities, deposit ticket and deposit transport timeframes are reviewed as part of Lockbox Performance Measures. Open. IRS’s corrective actions do not address the intent of this recommendation, which envisioned IRS testing courier compliance through observations or similar methods. During our fiscal year 2005 audit, we found instances where couriers did not follow IRS policies and procedures while transporting receipts and information. During our observations of couriers en route, we continued to find instances where couriers either made unauthorized stops before proceeding to the depository institution or left the vehicle unattended while it contained taxpayer receipts and information. Develop alternative, back-up plans that are consistent with IRS courier policies and procedures to address instances in which only one courier reports for transport of taxpayer receipts or information, such as requiring that a service center or lockbox bank employee accompany the courier to the depository. (short- term) Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr. 27, 2005) Closed. The 2005 LPG 4.2.3.1 “Courier Contingency Plan” was updated on July 18, 2005 (effective Aug. 29, 2005) to include a plan that ensures the security of receipts if courier requirements are not met, or the courier contractor is unable to send suitable replacement couriers in time to meet the bank’s deposit deadline. Submission Processing campuses submitted contingency plans in May 2005, which outline what deposit managers are to do in the event that couriers are unable to transport a deposit in the event of non-compliance with contract requirements, vehicle breakdown, or other reasons. In addition, the implementation of the Courier Daily Checklist in April 2005 has continued to work smoothly. Closed. During our fiscal year 2005 audit, we verified that IRS had updated its LPG for lockbox banks and submitted contingency plans for SCCs, which outline what to do in the event that couriers are unable to transport a deposit in the event of noncompliance with contract requirements. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr. 27, 2005) Open. Mission Assurance developed policy guidelines to address protection of security or critical controls. Mission Assurance will request transfer of this corrective action to W&I to coordinate with the business operating divisions and Procurement to incorporate any revised requirements into updated and future interagency agreements with FMS. Open. During our fiscal year 2005 audit, we verified that IRS continues to develop guidelines to address protection of security of critical controls. These corrective actions were not complete at the conclusion of our fiscal year 2005 fieldwork. We will continue to evaluate IRS’s corrective actions during our fiscal year 2006 audit. Require lockbox bank management to position closed-circuit television (CCTV) cameras to enable monitoring of secured areas containing sensitive systems or controls. (short-term) Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr. 27, 2005) Closed. Mission Assurance has developed and incorporated a CCTV evaluation matrix into the security review process ensuring that critical areas and assets are monitored. Every camera is assessed during the review. In addition, verbiage for the CCTV requirements is being strengthened in W&I’s new proposed LSG currently under development. The LSG will require at least one camera monitor the main utility feeds. Also, the LPG requires that the IRS security controls, equipment, and utilities must be locked to prevent tampering and that keys will be controlled and limited to authorized bank employees. Mission Assurance will also include key and combination controls and management as part of its review process at the banks. Open. During our fiscal year 2005 audit, we found a sensitive area in a lockbox bank that was not monitored by a camera. The corrective actions planned by IRS had not been implemented at the conclusion of our fieldwork. We will continue to assess IRS’s corrective actions during our fiscal year 2006 audit. Periodically monitor lockbox banks’ adherence to the LPG requirement that keys be kept in secured containers within the secured perimeter. (short-term) Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr. 27, 2005) Closed. The LSG was revised and published on January 1, 2006. The LSG requires strict control of keys, panels, and access to rooms and areas that contain facility utilities and controls. Lockbox banks are monitored and reviewed to ensure compliance to the policy. The Lockbox Physical Security Checklist includes checks to verify compliance to the policy. Five lockbox reviews have been conducted subsequent to publication of the LSG, and IRS has not observed any instances of this finding at any of the sites reviewed. Closed. During our fiscal year 2005 audit, we verified that IRS periodically monitored adherence to this requirement during its lockbox bank security reviews. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr. 27, 2005) Closed. IRS Lockbox Policy and Procedures staff determined that current technologies are not exempt from the candling requirement and added to the 2005 LPG 3.2.8(1) that envelopes opened (either manually or by OPEX) on three or more sides must be candled once on the candling tables. All other envelopes must be candled twice on the candling tables. Closed. IRS’s determination that current technologies are not exempt from the candling requirement, and the additional LPG guidelines added and verified by us during our fiscal year 2005 audit meets the objective of this recommendation. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr. 27, 2005) Closed. W&I determined that a cost benefit analysis was not necessary because it previously assessed the candling function on the automated equipment. To provide additional risk mediation, W&I revised the LPG under section 3.2.8 (1) to require that envelopes opened (either manually or by OPEX equipment) on three or more sides must be candled once on the candling tables. W&I will monitor adherence during site reviews. Closed. IRS’s determination that current technologies are not exempt from the candling requirement and the additional LPG guidelines added, and verified by us during our fiscal year 2005 audit meet the objective of this recommendation. Clarify the LPG to eliminate confusion about the number of candlings required for different extraction methods. (short-term) Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr. 27, 2005) Closed. IRS updated the 2005 LPG 3.2.8, Candling, to require that envelopes opened (either manually or by OPEX) on three or more sides must be candled once on the candling tables. All other envelopes must be candled twice on the candling tables. Closed. We verified that IRS updated the LPG to clarify requirements concerning the number of candlings. Establish guidelines and a testing requirement to ensure satisfactory lighting conditions for effective candling. (short-term) Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr. 27, 2005) Closed. IRM 3.10.72.6.2 (2) (a) requires that all candling equipment on both initial and final candling tables shall be adjusted as necessary to maintain maximum envelope recognition. Maximum envelope recognition is determined by the measurement of foot candles through use of a light meter. Minimum reading on the light meter should be 174. The testing of the candling equipment should be completed twice annually for IMF sites and quarterly for BMF sites. Testing will be completed prior to peak time-frames. Management or a designated employee will complete the candling equipment review log to verify lights are meeting minimum requirements. Light meters are available and testing has been completed at all SPCs to ensure requirements are met. Sorting table vendors have been contacted and are aware of this requirement and are adjusting all new tables that are purchased to ensure they are in compliance. Closed. During our fiscal year 2005 audit, we verified that IRS revised its IRM to include guidelines for testing lighting conditions for candling equipment. Establish policies and procedures to require appropriate segregation of duties in small business/self- employed units of field offices with respect to preparation of Payment Posting Vouchers, Document Transmittal forms, and transmittal packages. (short- term) Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr. 27, 2005) Open. IRS will establish a procedure(s) for SB/SE field office units to track Document Transmittal forms and acknowledgments of receipt of Document Transmittal forms. IRS will also strengthen guidance to revenue officers and will develop procedures specifically for its field clerical staff. IRS’s procedures will clarify that revenue officers are responsible for submitting an appropriately labeled sealed envelope containing the Daily Report of Collection Activity form to a designated clerical contact in the post of duty (POD). This guidance will apply unless the revenue officers are working away from the POD on extended field calls, flexiplace, or are working in a single revenue officer POD. Those revenue officers will send the envelope directly to Submission Processing. Open. IRS’s proposed corrective actions to this recommendation have not been finalized and published in the IRM. We will continue to monitor future developments in this area during our fiscal year 2006 audit. Enforce the requirement that a document transmittal form listing the enclosed Daily Report of Collection Activity forms be included in transmittal packages, using such methods as more frequent inspections or increased reliance on error reports compiled by the service center teller units receiving the information. (short-term) Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr. 27, 2005) Closed. In 2005, Remittance Training covering the procedures for remittance processing was conducted for all TAC managers. The requirement for including a document transmittal form listing the Daily Report of Collection Activity forms in the transmittal package was emphasized. Field Assistance headquarters began operational reviews on February 28, 2006 to, among other things, ensure TAC adherence to required IRM procedures. Additional emphasis was placed on development of internal controls and the oversight and accountability of both employees and managers within Field Assistance. Specifically, Field Assurance headquarters began conducting operational reviews on February 28, 2006. The operational reviews include assessing their ability to engage employees in process and program improvement, identifying best practice ideas, ensuring elements of accountability and responsibility are clearly communicated at each level, and assessing conformance to the current policies and procedures. Open. During our fiscal year 2005 audit, we found that three of eight TACs we visited did not use a document transmittal to transmit multiple Daily Report of Collection Activity forms to their respective SCC for further processing. We will continue to evaluate IRS’s implementation of its corrective actions during our fiscal year 2006 audit. Establish a procedure for SB/SE field office units to track Document Transmittal forms and acknowledgments of receipt of Document Transmittal forms. (short-term) Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr. 27, 2005) Open. IRS will update its procedures to clarify that the managers should ensure continuous coverage of the designated clerical contact duties so that absence due to illness or leave does not disrupt the processing of remittances. Open. IRS’s corrective actions were not implemented during our fiscal year 2005 audit. In addition, our audit continued to find numerous instances of SB/SE groups not properly tracking document transmittal forms to ensure that taxpayer receipts and information were received by the recipient. We will evaluate IRS’s corrective actions during our fiscal year 2006 audit. Require evidence of managerial review of recording, transmittal, and receipt of acknowledgments of taxpayer receipts and information. (short- term) Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr. 27, 2005) Open. IRS will establish a procedure(s) to require evidence of managerial review of recording, transmittal, and receipt of acknowledgments of taxpayer receipts and information. However, IRS will not implement any procedure requiring 100 percent managerial review. IRS’s new procedures will call for random managerial spot-checking of packages prepared for submission to Submission Processing by revenue officers working in PODs or by the designated clerical contacts in the PODs. The new procedure(s) will not call for any random managerial spot-checking of packages prepared by revenue officers working away from the POD on extended field calls or flexiplace. Instead, on those packages, IRS will continue to rely on the remittance reviews conducted by remittance processing personnel in Submission Processing. These reviews will be documented by the revenue officer group manager and be retained for the appropriate period required under record management guidelines. Open. IRS’s corrective actions were not implemented during our fiscal year 2005 audit. In addition, we continued to find numerous instances where SB/SE groups did not provide evidence that managers, or a designee, reviewed the recording, transmittal, and receipt of acknowledgements of taxpayer receipts and information to ensure that they were received and acknowledged by the recipient. We will evaluate IRS’s corrective actions during our fiscal year 2006 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr. 27, 2005) Closed. IRS’s position is that, if followed, the procedures it has in place adequately address preventing the generation or disbursement of refunds associated with AUR accounts. IRM 3.8.45 requires employees receiving an unidentified remittance to conduct Integrated Data Retrieval System (IDRS) research to determine if there is an open account that allows for posting of the remittance. Also, AUR will partner with SP to ensure that employees receiving unidentified remittances are aware of the need to conduct IDRS research and how to properly post AUR remittances in these instances. Open. During our fiscal year 2005 audit, we found a technician in the Unidentified Remittance unit unaware of how to properly post remittances for AUR cases. We will continue to monitor IRS’s efforts in preventing the generation or disbursements of refunds associated with AUR accounts during our fiscal year 2006 financial audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr. 27, 2005) Closed. A memorandum was issued on August 3, 2005, as a reminder to solicit the annual list of authorized signatures (individuals formally delegated authority to sign manual refunds). The campuses were advised to submit a memorandum to National Office no later than October 31, certifying they had completed the request for authorized signatures. This information was also conveyed via Information Alert: W&I-IA-2002- 1149-2005, dated March 17, 2005; and will be covered by BMF headquarter staff during their unannounced visits. Open. During our fiscal year 2005 audit, we continued to find issues with the documentation requirements relating to authorizing officials charged with approving manual refunds. For example, IRS policy requires that IRS submit a memorandum identifying the personnel designated to authorize manual refunds. The list must include the name, title/position, and signature of the designated person and official issuing the memorandum. However, during our July 2005 testing, we found memorandums that were either over a year old or lacked the required information. The reminder memorandum Submission Processing issued on August 3, 2005, was issued subsequent to our July 2005 fieldwork. We will continue to follow up on IRS’s efforts to improve the documentation requirements during our fiscal year 2006 financial audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr. 27, 2005) Closed. Submission Processing issued an alert on the SP Web site on March 17, 2005. A reminder memorandum was issued on August 3, 2005. IRM check sheets were included, and campuses were required to confirm actions taken. IRS determined this item would not be included in the management accountability review process. As part of our commitment to improve the manual refund process, an attachment covering monitoring was included with the annual memorandum soliciting authorized manual refund signers. In response to the Service-wide Electronic Research Program (SERP) alert issued by Accounts Management, we included items that should be considered when Accounting Operations reviewed manual refund requests initiated by employees in the SP campuses. This will be covered by BMF headquarter staff during their unannounced visits. Open. During our fiscal year 2005 audit, we continued to find instances where the manual refund initiators did not monitor accounts to prevent duplicate refunds, and supervisors did not review the monitoring of accounts. We reviewed the alerts that IRS issued on April 1, 2005 (Monitoring Manual Refunds) and May 13, 2005 (Managerial Procedures for Manual Refunds). However, we found that some of the manual refund initiators, leads, supervisors and managers were unaware of the alerts. The reminder memorandum issued on August 3, 2005 was issued subsequent to our July 2005 testing. We will continue to review IRS’s monitoring and review efforts during our fiscal year 2006 financial audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr. 27, 2005) Closed. Submission Processing issued a reminder memorandum on August 3, 2005. IRM check sheets were included, and campuses were required to confirm actions taken. IRS determined this item would not be included in the management accountability review process. As part of our commitment to improve the manual refund process, an attachment covering monitoring was included with the annual memorandum soliciting authorized manual refund signers. In response to the SERP alert issued by Accounts Management, we included items that should be considered when Accounting Operations reviewed manual refund requests initiated by employees in the SP campuses. This will be covered by BMF headquarter staff during their unannounced visits. Open. During our fiscal year 2005 audit, we found the requirements for documenting monitoring actions and documenting supervisory review were not always enforced. The reminder memorandum issued on August 3, 2005, was issued subsequent to our July 2005 testing. We will continue to monitor IRS’s efforts in documenting the monitoring actions and documenting the supervisory review during our fiscal year 2006 financial audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr. 27, 2005) Closed. SP supports Mission Assurance in enforcing IDRS security by ensuring appropriate officials are reminded annually of their security obligations. A memorandum, including IDRS security and the Automated Command Code Access Control, was issued August 3, 2005. IRS determined this item would not be included in the management accountability review process. An overview of the Automated Command Code Access Control (ACCAC) program was included in our Annual Solicitation for Authorized Signatures – Manual Refunds memorandum, dated August 3, 2005. This will be covered by BMF headquarter staff during their unannounced visits. Open. During our fiscal year 2005 audit, we found that the requirement for the annual review of command code profiles was not always enforced. The reminder memorandum issued on August 3, 2005 was issued subsequent to our July 2005 fieldwork. We will continue to follow up on IRS’s efforts in enforcing the requirement to review command code profiles at least once annually during our fiscal year 2006 financial audit. Specify in the IRM that staff members are not to review their own command code profiles. (short-term) Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr. 27, 2005) Open. The IRM wording will be updated, and recommendations will be included in annual reminders (memos, notices, etc.) to management officials that the approver’s manager is responsible for ensuring that approvers’ profiles have appropriate restrictions and have been reviewed. Mission Assurance updated its project Web page in January 2005, advising managers and unit security representatives to review IDRS user profiles to ensure that the appropriate restrictions have been added to the user’s profile. Limited staffing resources have impacted the actual updating of the IDRS Security Law Enforcement Manual (LEM). The LEM wording will be updated to require managers and unit security representatives to review the IDRS security profiles to ensure that appropriate restrictions have been placed against the user’s IDRS account. The LEM is expected to be revised by July 15, 2006. Open. During our fiscal year 2005 audit, we found that the IRM wording to specify that staff members to not review their own command code profiles had not been updated. We will continue to monitor IRS’s efforts in preventing staff members to review their own command code profiles during our fiscal year 2006 audit. Specify in the IRM how to properly verify interest and penalties for accounts with liens with manually calculated interest or penalties. (short-term) Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr. 27, 2005) Closed. IRS revised the IRM to instruct employees to check the IDRS to determine if restricted interest or penalty is due. The IRM now clearly states that there are only two instances where restricted interest and penalty should not be computed, offer-in- compromise and bankruptcy cases. Also, instructions for computing restricted interest and penalty are found in the ALS User Guide as well as in training material and desk guides. In addition, tax examiners hired to staff the Centralized Case Processing (CCP), Lien Processing Unit were provided hands-on training in the computation of restricted interest and penalty. Resolution of these cases moved to CCP effective February 2005. The centralized site has created a special group of employees who were trained in the resolution of restricted interest and penalty cases. New hires for this group will also receive this training. The LEM will be updated to reflect the changes made by the RIS. Open. According to IRS, an internal study determined that the dollar amounts of additional interest and penalty to be assessed on cases with liens requiring manual calculations was not significant. Consequently, IRS is in the process of revising the IRM to no longer require the additional manual computation and assessment of interest and penalty on such cases. In addition, IRS updated its computer programs to automatically release liens once the current account balance had been satisfied. IRS’s actions are based on its determination that the additional interest and penalty amounts are not significant. We will review the results of IRS’s internal analysis during our fiscal year 2006 audit. Require that Refund Inquiry Unit managers or supervisors document their review of all forms used to record and transmit returned refund checks prior to sending them for final processing. (short- term) Management Report: Improvements Needed in IRS’s Internal Controls (GAO-06-543R, May 12, 2006) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open. This is a recent recommendation. We will review IRS’s corrective actions during future audits. Enforce compliance with existing requirements that all IRS units transmitting taxpayer receipts and information from one IRS facility to another, including SCCs, TACs, and units within LMSB and TE/GE, establish a system to track acknowledged copies of document transmittals. (short- term) Management Report: Improvements Needed in IRS’s Internal Controls (GAO-06-543R, May 12, 2006) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open. This is a recent recommendation. We will review IRS’s corrective actions during future audits. Provide instructions to document the follow- up procedures performed in those cases where transmittals have not been timely acknowledged. (short- term) Management Report: Improvements Needed in IRS’s Internal Controls (GAO-06-543R, May 12, 2006) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open. This is a recent recommendation. We will review IRS’s corrective actions during future audits. Require that managers or supervisors document their reviews of document transmittals to ensure that taxpayer receipts and/or taxpayer information mailed between IRS locations are tracked according to guidelines. (short- term) Management Report: Improvements Needed in IRS’s Internal Controls (GAO-06-543R, May 12, 2006) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open. This is a recent recommendation. We will review IRS’s corrective actions during future audits. Equip all TACs with adequate physical security controls to deter and prevent unauthorized access to restricted areas or office space occupied by other IRS units, including those TACs that are not scheduled to be reconfigured to the “new TAC” model in the near future. This includes appropriately separating customer service waiting areas from restricted areas by physical barriers such as locked doors marked with signs barring entrance by unescorted customers. (short- term) Management Report: Improvements Needed in IRS’s Internal Controls (GAO-06-543R, May 12, 2006) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open. This is a recent recommendation. We will review IRS’s corrective actions during future audits. Connect duress alarms to a central monitoring station or local police department or institute appropriate compensating controls when these alarm systems are not operable or in place. (short-term) Management Report: Improvements Needed in IRS’s Internal Controls (GAO-06-543R, May 12, 2006) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open. This is a recent recommendation. We will review IRS’s corrective actions during future audits. Document supervisory visits by offsite managers to TACs not having a manager permanently on-site. This documentation should be signed by the manager and should (1) record the time and date of the visit, (2) identify the manager performing the visit, (3) indicate the tasks performed during the visit, (4) note any problems identified, and (5) describe corrective actions planned. (short-term) Management Report: Improvements Needed in IRS’s Internal Controls (GAO-06-543R, May 12, 2006) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open. This is a recent recommendation. We will review IRS’s corrective actions during future audits. Enforce the requirement that all security or other responsible personnel at SCCs and lockbox banks record all instances involving the activation of intrusion alarms regardless of the circumstances that may have caused the activation. (short- term) Management Report: Improvements Needed in IRS’s Internal Controls (GAO-06-543R, May 12, 2006) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open. This is a recent recommendation. We will review IRS’s corrective actions during future audits. Reemphasize the need for the security guards at all TACs to ensure that key PODs, such as entrances to facilities, are not left unattended. (short- term) Management Report: Improvements Needed in IRS’s Internal Controls (GAO-06-543R, May 12, 2006) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open. This is a recent recommendation. We will review IRS’s corrective actions during future audits. Revise lockbox bank’s security review checklist to ensure that it encompasses reviewing security incident reports to validate whether security personnel are providing corrective actions related to the incidents cited. (short- term) Management Report: Improvements Needed in IRS’s Internal Controls (GAO-06-543R, May 12, 2006) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open. This is a recent recommendation. We will review IRS’s corrective actions during future audits. Refine the scope and nature of its periodic reviews of candling processes at SCCs to ensure they (1) encompass tests of whether envelopes are properly candled through observation of candling in process and inquiry of employees who perform initial and final candling, and (2) document the nature and scope of the test and observation results. (short-term) Management Report: Improvements Needed in IRS’s Internal Controls (GAO-06-543R, May 12, 2006) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open. This is a recent recommendation. We will review IRS’s corrective actions during future audits. Enforce its existing policies and procedures at lockbox banks to ensure that all remittances of $50,000 or more are processed immediately and deposited at the first available opportunity. (short-term) Management Report: Improvements Needed in IRS’s Internal Controls (GAO-06-543R, May 12, 2006) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open. This is a recent recommendation. We will review IRS’s corrective actions during future audits. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-06-543R, May 12, 2006) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open. This is a recent recommendation. We will review IRS’s corrective actions during future audits. Refine the scope and nature of its periodic security reviews to encompass (1) testing the effectiveness of controls intended to ensure that only individuals with proper credentials are permitted access to SCCs and lockbox banks, and (2) reviewing the integrity of perimeter security at SCCs. (short-term) Management Report: Improvements Needed in IRS’s Internal Controls (GAO-06-543R, May 12, 2006) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open. This is a recent recommendation. We will review IRS’s corrective actions during future audits. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-06-543R, May 12, 2006) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open. This is a recent recommendation. We will review IRS’s corrective actions during future audits. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-06-543R, May 12, 2006) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open. This is a recent recommendation. We will review IRS’s corrective actions during future audits. Require IRS personnel to verify the information on the form 13094 by contacting the reference directly. (short-term) Management Report: Improvements Needed in IRS’s Internal Controls (GAO-06-543R, May 12, 2006) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open. This is a recent recommendation. We will review IRS’s corrective actions during future audits. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-06-543R, May 12, 2006) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open. This is a recent recommendation. We will review IRS’s corrective actions during future audits. Establish procedures for hiring juveniles who do not have a current teacher, principal, counselor, employer or former employer, and clarify that IRS’s current policies and procedures should not be interpreted to mean that such juveniles should be allowed access to taxpayer receipts and information without a form 13094 or its equivalent. These procedures could include a list of acceptable alternatives that may serve as references for juveniles who do not have a current teacher, principal, or guidance counselor. (short-term) Management Report: Improvements Needed in IRS’s Internal Controls (GAO-06-543R, May 12, 2006) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open. This is a recent recommendation. We will review IRS’s corrective actions during future audits. To assure proper accounting treatment of expense and P&E transactions and reliable financial reporting, we recommend that IRS enforce its property and equipment capitalization policy to ensure that it is properly implemented to fully achieve management’s objectives, including recognizing assets when its capitalization criteria is met and recognizing expenses when it is not. (short- term) Management Report: Improvements Needed in IRS’s Internal Controls (GAO-06-543R, May 12, 2006) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open. This is a recent recommendation. We will review IRS’s corrective actions during future audits. reports when an asset remains in pending disposal status for longer than a specified period of time. (short-term) Management Report: Improvements Needed in IRS’s Internal Controls (GAO-06-543R, May 12, 2006) Open. In March 2006 the chief information officer (CIO) property program manager informed GAO that issues raised in the FY 2005 Financial Statement Audit are being addressed via a re- engineering effort focused on the entire asset retirement and disposal process. As such, reports are currently available to monitor aging transactions during the disposal life cycle. Additionally, procedures are being developed to require reviews of aging reports for the timely recording of disposal transactions. Substantial software modifications are being designed to improve the recording of information by replacing manual data entry methods by using electronic forms, signatures, and processes. In August 2006 these modifications and review procedures will be implemented to streamline the recording of asset disposal activity as required by IRS policy. Open. This is a recent recommendation. We will review IRS’s corrective actions during future audits. Direct Facilities Management Branch managers to research and resolve the aging reports. (short-term) Management Report: Improvements Needed in IRS’s Internal Controls (GAO-06-543R, May 12, 2006) Open. AWSS and CIO property managers have been working on reengineering the entire asset retirement and disposal process to mitigate issues raised in GAO’s FY 2005 Financial Statement Audit. CIO staff reported on that initiative to GAO in March 2006. As such, reports are currently available for management to monitor the status of aging transaction dates until the disposal process is complete. Also, review procedures are being developed to streamline the process to ensure the timely recording of disposal transactions. In August 2006, reengineered process modifications and review procedures will be implemented and guidance for conducting reviews will be issued. Open. This is a recent recommendation. We will review IRS’s corrective actions during future audits. The following individuals made major contributions to this report: William J. Cordrey, Charles Fox, Paul Foderaro, Nina Crocker, John Davis, Charles Ego, David Elder, Ted Hu, Jerrod O’Nelio, John Sawyer, Peggy Smith, Lisa Warde, Gary Wiggins, and Mark Yoder.

Summary: In its role as the nation's tax collector, the Internal Revenue Service (IRS) has a demanding responsibility in annually collecting over $2 trillion in taxes, processing hundreds of millions of tax and information returns, and enforcing the nation's tax laws. Since its first audit of IRS's financial statements in fiscal year 1992, GAO has identified a number of weaknesses in IRS's financial management operations. In related reports, GAO has recommended corrective action to address those weaknesses. Each year, as part of the annual audit of IRS's financial statements, GAO not only makes recommendations to address any new weaknesses identified but also follows up on the status of weaknesses GAO identified in previous years' audits. The purpose of this report is to (1) assist IRS management in tracking the status of audit recommendations and actions needed to fully address them and (2) demonstrate how the recommendations fit into IRS's overall management and internal control structure. IRS has made significant progress in improving its internal controls and financial management since its first financial audit in 1992, as evidenced by 6 consecutive years of clean audit opinions on its financial statements, the resolution of several material internal control weaknesses, and the closing of over 200 financial management recommendations. This progress has been the result of hard work and commitment at the top levels of the agency. However, IRS still faces financial management challenges. At the beginning of GAO's audit of IRS's fiscal year 2005 financial statements, 84 financial management-related recommendations from prior audits remained open because IRS had not fully addressed the issues that gave rise to them. During the fiscal year 2005 financial audit, IRS took actions that enabled GAO to close 34 of those recommendations. At the same time, GAO identified additional internal control deficiencies resulting in 22 new recommendations. In total, 72 recommendations currently remain open. To assist IRS in evaluating its internal controls and in making improvements, GAO categorized the 72 open recommendations by various internal control activities which, in turn, were grouped into three broad control activity groupings. The continued existence of internal control weaknesses that gave rise to these recommendations represents a serious obstacle that IRS needs to overcome. Effective implementation of GAO's recommendations can greatly assist IRS in improving its internal controls and achieving sound financial management. IRS stated that it is taking action to address the recommendations included in the report. GAO will review the effectiveness of these corrective actions and the status of IRS's progress as part of the fiscal year 2006 audit.