Internal control is not one event, but a series of activities that occur throughout an entity’s operations and on an ongoing basis. Internal control should be an integral part of each system that management uses to regulate and guide its operations rather than as a separate system within an agency. In this sense, internal control is management control that is built into the entity as a part of its infrastructure to help managers run the entity and achieve their goals on an ongoing basis. Section 3512 (c), (d) of Title 31, U.S. Code, commonly known as the Federal Managers’ Financial Integrity Act of 1982 (FMFIA), requires agencies to establish and maintain effective internal control. The agency head must annually evaluate and report on the control and financial systems that protect the integrity of its federal programs. The requirements of FMFIA serve as an umbrella under which other reviews, evaluations, and audits should be coordinated and considered to support management’s assertion about the effectiveness of internal control over operations, financial reporting, and compliance with laws and regulations. Office of Management and Budget (OMB) Circular No. A-123, Management’s Responsibility for Internal Control, provides the implementing guidance for FMFIA, and prescribes the specific requirements for assessing and reporting on internal controls consistent with the Standards for Internal Control in the Federal Government (internal control standards) issued by the Comptroller General of the United States. The circular defines management’s responsibilities related to internal control and the process for assessing internal control effectiveness, and provides specific requirements for conducting management’s assessment of the effectiveness of internal control over financial reporting. Specifically, the circular requires management to annually provide assurances on internal control in its performance and accountability report, and, for each of the 24 Chief Financial Officers (CFO) Act agencies, to include a separate assurance on internal control over financial reporting, along with a report on identified material weaknesses and corrective actions. The circular also emphasizes the need for integrated and coordinated internal control assessments that synchronize all internal control–related activities. FMFIA requires GAO to issue standards for internal control in the federal government. The internal control standards provide the overall framework for establishing and maintaining effective internal control and for identifying and addressing major performance and management challenges and areas at greatest risk of fraud, waste, abuse, and mismanagement. As summarized in the internal control standards, internal control in the government is defined by the following five elements, which also provide the basis against which internal controls are to be evaluated: Control environment: Management and employees should establish and maintain an environment throughout the organization that sets a positive and supportive attitude toward internal control and conscientious management. Risk assessment: Internal control should provide for an assessment of the risks the agency faces from both external and internal sources. Control activities: Internal control activities help ensure that management’s directives are carried out. The control activities should be effective and efficient in accomplishing the agency’s control objectives. Information and communication: Information should be recorded and communicated to management and others within the entity who need it and in a form and within a time frame that enables them to carry out their internal control and other responsibilities. Monitoring: Internal control monitoring should assess the quality of performance over time and ensure that the findings of audits and other reviews are promptly resolved. A key objective in our annual audits of IRS’s financial statements is to obtain reasonable assurance that IRS maintained effective internal control with respect to financial reporting. While we use all five elements of internal control as a basis for evaluating the effectiveness of IRS’s internal controls, our ongoing evaluations and tests have focused heavily on control activities, where we have identified numerous internal control weaknesses and have provided recommendations for corrective action. Control activities are the policies, procedures, techniques, and mechanisms that enforce management’s directives. In other words, they are the activities conducted in the everyday course of business that are intended to accomplish a control objective, such as ensuring IRS employees successfully complete background checks prior to being granted access to taxpayer information and receipts. As such, control activities are an integral part of an entity’s planning, implementing, reviewing, and accountability for stewardship of government resources and achievement of effective results. To accomplish our objectives, we evaluated the effectiveness of corrective actions IRS implemented during fiscal year 2009 in response to open recommendations as part of our fiscal years 2009 and 2008 financial audits. To determine the current status of the recommendations, we (1) obtained IRS’s reported status of each recommendation and corrective action taken or planned as of April 2010, (2) compared IRS’s reported status to our fiscal year 2009 audit findings to identify any differences between IRS’s and our conclusions regarding the status of each recommendation, and (3) performed additional follow-up work to assess IRS’s actions taken to address the open recommendations. For our recommendations to IRS regarding information security, this report includes only summary data on the number of those recommendations and their general nature. We have reported the objectives and results of our information security work separately to IRS because of the sensitive nature of many of the issues identified for which we have made recommendations for corrective action. In order to determine how IRS’s open recommendations, including the latest ones in our June 2010 management report, fit within the agency’s management and internal control structure, we compared the open recommendations and the issues that gave rise to them to the (1) control activities listed in the internal control standards, (2) list of major factors and examples outlined in our Internal Control Management and Evaluation Tool, and (3) criteria and objectives for federal financial management as discussed in the CFO Act of 1990 and the Federal Accounting Standards Advisory Board’s (FASAB) Statement of Federal Financial Accounting Concepts No. 1, Objectives of Federal Financial Reporting. We also considered whether IRS had addressed, in whole or in part, the underlying control issues that gave rise to the recommendations; and other legal requirements and implementing guidance, such as OMB Circular No. A-123 and FMFIA. Our work was performed from December 2009 through May 2010 in accordance with generally accepted government auditing standards. IRS continues to make progress in resolving its internal control weaknesses and addressing outstanding recommendations, but it still faces significant financial management challenges. Since we first began auditing IRS’s financial statements in fiscal year 1992, IRS has taken a significant number of actions that enabled us to eliminate several material weaknesses and significant deficiencies and to close over 250 of our previously reported financial management–related recommendations. This includes 18 recommendations we are closing with this report based on actions IRS took through April 2010. Nevertheless, IRS continues to face significant challenges in improving the effectiveness of its financial and operational management. Specifically, IRS continues to face management challenges in (1) resolving its two remaining material weaknesses in internal control, (2) developing performance measures and managing for outcomes, and (3) addressing its remaining internal control issues, particularly those dealing with safeguarding of taxpayer receipts and information. Further, as in previous years’ audits, our fiscal year 2009 audit continued to identify additional internal control issues, resulting in 41 new recommendations for corrective action we discussed in detail in our June 2010 management report to IRS. In addition, as noted earlier, we also identified several issues related to information security during our fiscal year 2009 audit that we reported separately because of the sensitive nature of many of those issues. As we reported in our audit of IRS’s fiscal year 2009 financial statements, IRS’s efforts to address its internal control weaknesses resulted in our closure of a material weakness in internal control over financial reporting and a significant deficiency in internal control over tax revenue and refunds. However, as we also reported in that audit, IRS continues to face significant challenges in resolving its two remaining material weaknesses in internal control concerning (1) unpaid tax assessments and (2) information security. IRS’s continuing challenge in addressing its material weakness in internal control over unpaid tax assessments results from its (1) inability to use its core general ledger system for tax administration–related transactions to support its reported balances for taxes receivable and other unpaid assessments, (2) lack of a subsidiary ledger for unpaid tax assessments that would allow it to produce reliable, useful, and timely information with which to manage and report externally on these key transactions, and (3) errors and delays in recording taxpayer information, payments, and other activities. These control deficiencies impede IRS’s ability to properly manage and routinely report certain information on unpaid tax assessments and lead to increased taxpayer burden. IRS’s continuing challenge in addressing its material weakness in internal control over information security is primarily due to IRS not having fully implemented its information security program. As we reported in our audit of IRS’s fiscal year 2009 financial statements, IRS has not (1) restricted users’ ability to bypass application controls, (2) removed separated employees’ system access in a timely manner, (3) followed required procedures to timely review employee access to sensitive areas at data centers, (4) restricted system access to only those who needed it, (5) instituted adequate separation of duties for its procurement system, and (6) developed adequate encryption controls over user login. IRS’s deficiencies in internal control over information security result in IRS’s inability to rely on the controls embedded in its automated financial management systems to provide reasonable assurance that its (1) financial statements are fairly stated in accordance with U.S. generally accepted accounting principles, (2) financial information that management relies on to support day-to-day decision making is current, complete, and accurate, and (3) proprietary information processed by these automated systems is appropriately safeguarded. These deficiencies also increase the risk that unauthorized individuals could access, alter, or abuse proprietary IRS programs and electronic data and taxpayer information without detection. We have made numerous recommendations to IRS over the years— including new recommendations resulting from our fiscal year 2009 financial audit—to address the issues constituting these two material internal control weaknesses. Successfully implementing these recommendations would assist IRS in fully resolving these weaknesses. To its credit, IRS continues to work to address the issues underlying these two material weaknesses. As we reported in our audit of IRS’s fiscal year 2009 financial statements, IRS continues to face significant challenges in developing and instutionalizing the use of financial management information to assist it in making operational decisions and in measuring the effectiveness of its programs. IRS’s management has not developed the data or outcome-oriented performance measures that would enhance its ability to manage for outcomes. For example, it has not integrated the use of cost-based (and when appropriate, revenue-based) performance metrics into its routine management and decision-making processes or externally reported performance metrics. Although IRS has developed projected return on investment estimates for new enforcement (tax collection) initiatives in its annual budget submissions, it has not developed similar outcome-oriented performance metrics to determine whether funded initiatives achieve their estimated goals. IRS has also not developed outcome-oriented performance metrics for its existing enforcement programs. These limitations inhibit IRS’s ability to more fully assess and monitor the relative merits of its existing programs, to evaluate new initiatives, or to consider alternatives and adjust its strategies as needed. Outcome-oriented performance metrics based on specific enforcement programs’ costs and revenues should improve IRS’s ability to (1) establish measurable outcome goals, (2) evaluate the relative merits of various program options, and (3) highlight opportunities for optimizing the allocation of resources. They can also help IRS more credibly demonstrate to Congress and the public that it is spending its appropriations wisely. IRS’s existing metrics focus on process-oriented workload measures of program outputs rather than on measuring program outcomes. For example, for its enforcement programs, IRS focuses on measuring discrete activities within its overall tax collection efforts, such as the percentage of various types of tax returns examined, criminal investigations completed, and the number of tax returns examined and closed. While such output measures can be useful elements in assessing performance, they are not designed to measure the contribution each of these activities makes to the collection of unpaid taxes, nor do they compare the cost of collection activities to the tax revenue generated. IRS’s enforcement metrics do not include revenue collected—a measure of outcome—compared to the cost of collection that could show the net monetary benefits of the enforcement programs. In addition, IRS’s publicly available performance metrics do not measure the cost of IRS’s programs either in the aggregate or per service or activity performed. As we report in the “Status per IRS” section of appendix I in this report, IRS has reported that it considers our recommendation to develop outcome-oriented performance measures and related performance goals for IRS’s enforcement programs and activities to be closed. We do not agree. Part of IRS’s justification for closing the recommendation is that IRS uses cost-benefit return on investment analysis to evaluate future scenarios and to support funding requests for new initiatives in its annual budget submissions. Such prospective return on investment information is useful for budgetary decision making, but our recommendation is for IRS to develop outcome data on the actual results of its programs and activities. We have also previously recommended that IRS (1) extend the use of return on investment in future budget proposals to include major enforcement programs and (2) develop return on investment data for its enforcement programs using actual revenue and full cost data and compare actual results to the projected return on investment data included in its budget request. Our recommendations regarding development of outcome-oriented performance metrics remain open because, as noted above, IRS does not develop such data for either funded initiatives or for ongoing enforcement programs and activities and it has not deployed outcome-oriented performance measures. IRS also reported that return on investment information is but one tool that can be utilized to improve resource-allocation decision making, and it is not prudent to rely exclusively on return on investment as the sole determinant of resource allocation. As we have reported previously, we acknowledge that IRS must consider other factors besides maximizing revenue collection and least-cost operations. The fairness of IRS’s implementation of the tax code and treatment of all taxpayers are important, and we are cognizant of the many factors, such as coverage, that are important considerations when making resource-allocation decisions. These factors, and the decisions IRS makes about how to respond to them, have a significant effect on taxpayers, as well as on tax collections. However, using full cost and collection outcome-oriented performance metrics are also important to make optimum use of its available resources and to be able to credibly demonstrate it is doing so to Congress and the public. For several years, IRS has been developing full cost data on its programs and activities in response to a recommendation we made in 1999. However, as we have reported in the past, IRS’s efforts have been slowed because IRS cannot produce full cost information down to the program and activity levels directly from its cost accounting system, the Integrated Financial System (IFS). IRS has partially overcome this difficulty by developing the ability to manually combine cost data from IFS with personnel time-charge data from IRS’s various workload management systems and revenue data for enforcement programs to develop full cost (and revenue) information for selected programs. IRS’s lack of outcome-oriented performance metrics is inconsistent with federal financial management concepts as embodied in FASAB’s Statement of Federal Financial Accounting Concepts No. 1, Objectives of Federal Financial Reporting. In its discussion of financial reporting concepts, FASAB notes that federal financial data should provide accountability and decision-useful information on the costs of programs and the outputs and outcomes achieved, and it should provide data for evaluating service efforts, costs, and accomplishments. The absence of outcome metrics is also inconsistent with the objectives of the CFO Act of 1990. A key objective of the act was for agencies to routinely develop and use appropriate financial management information to evaluate program effectiveness, make fully informed operational decisions, and ensure accountability. While obtaining a clean audit opinion on its financial statements is important in itself, it is not the end goal reflected in the act. The end goal is modern financial management systems that provide reliable, timely, and useful financial information to support day-to-day decision making and oversight. Such systems and practices should also provide for the systematic measurement of both outputs and outcomes. Developing the data and performance metrics necessary for a more outcome-oriented approach to managing operations requires active and sustained senior management leadership. We acknowledge that without the benefit of integrated financial management systems, IRS faces significant challenges in developing outcome-oriented performance metrics, including the data needed for such metrics. However, undertaking such an effort agencywide will enhance IRS’s ability to effectively measure and compare the benefits of its programs to make better informed resource-allocation decisions and to better support its budget requests. We have made several recommendations to IRS over the years to address its financial management challenges in developing full cost data for its programs and activities and for outcome-oriented performance measures. Successfully addressing the remaining open recommendations would enhance IRS’s ability to effectively manage for outcomes. As discussed earlier, IRS has taken significant actions over the years to resolve internal control weaknesses and this has enabled us to close over 250 internal control–related recommendations. The closure of such a high number of recommendations indicates that IRS has a strong commitment to improving its internal control. However, IRS also continues to face a challenge in addressing numerous other unresolved internal control issues in several aspects of its operations that, while neither individually nor collectively representing a material weakness, nonetheless merit management attention to ensure they are fully and effectively addressed. IRS now has a total of 70 open audit recommendations resulting from internal control issues that we report as “other control issues” in appendix II of this report. While most were identified during our recent financial audits, some were identified in our audits as far back as 1999 and 2001. Over half of those 70 open recommendations address issues related to the physical safeguarding of tax receipts and taxpayer information, a critical aspect of IRS’s responsibilities. IRS processes billions of dollars annually in checks and currency and other valuable assets, and it must physically safeguard and account for them to prevent theft, fraud, and misuse. To do so, IRS has established physical security, accountability, and accounting policies, processes, and procedures to manage its activities involving the transportation and accounting for tax receipts and for handling and storing taxpayer information. Although IRS has made substantial improvements in safeguarding taxpayer receipts and information since our financial audits first began surfacing serious internal control issues in this area, the task of ensuring ongoing control over such critical responsibilities for IRS is a difficult one. Each year, we continue to identify control issues related to IRS’s safeguarding of taxpayer receipts and information. For example, based on our fiscal year 2009 audit, we identified new internal control issues and made 19 additional recommendations that related either directly or indirectly to the physical safeguarding of taxpayer receipts and information. The internal control issues encompassed in our recommendations cover critical physical security functions, such as transporting taxpayer receipts and sensitive taxpayer information among IRS facilities and lockbox banks and maintaining physical security at IRS facilities to prevent loss, theft, or the potential for fraud regarding tax receipts and taxpayer information; conducting inspections and audits of the design and operation of IRS’s physical security processes and controls designed to safeguard tax receipts and taxpayer information; conducting appropriate background investigations and screening of personnel, including contractors, with access to IRS facilities and lockbox bank operations; and ensuring the proper destruction of documents to prevent the inappropriate release of sensitive taxpayer information. Due to the volume of taxpayer receipts and sensitive taxpayer files that IRS is responsible for safeguarding, and the implications for IRS’s mission if they are lost, stolen, or the subject of fraud or misuse, it is critical that IRS successfully resolve the internal control issues we have identified and work toward continually improving its internal controls to prevent new issues from arising. In June 2009, we issued a report on the status of IRS’s efforts to implement corrective actions to address financial management recommendations stemming from our fiscal year 2008 and prior year financial audits and other financial management–related work. In that report, we identified 62 audit recommendations that remained open and thus required corrective action by IRS. A significant number of these recommendations had been open for several years, either because IRS had not taken corrective action or because the actions taken had not yet effectively resolved the issues that gave rise to the recommendations. IRS continued to work to address many of the internal control issues to which these open recommendations relate. In the course of performing our fiscal year 2009 financial audit, we identified numerous actions IRS took to address many of its internal control issues. On the basis of IRS’s actions, which we were able to substantiate through our audit, we have closed 18 of these prior years’ recommendations. However, a total of 44 recommendations from prior years remain open, a significant number of which have been outstanding for several years. IRS considers another 21 of the prior years’ recommendations to be effectively addressed and therefore closed. However, we consider them to remain open. For 14 of the 21, in our view, IRS’s actions did not fully address the issue that gave rise to the recommendations. For the remaining seven, we have not yet been able to verify the effectiveness of IRS’s actions. (See app. I, “Status per GAO,” for our assessment of IRS’s actions on each recommendation). During our audit of IRS’s fiscal year 2009 financial statements, we identified additional issues that require corrective action. In our June 2010 management report to IRS, we discussed these issues, and made 41 new recommendations to address them. Consequently, a total of 85 financial management–related recommendations need to be addressed—44 from prior years and 41 new ones from our fiscal year 2009 audit. We consider all of the new recommendations to be short-term. We also consider the majority of the recommendations outstanding from prior years to be short-term; however, a few, particularly those concerning the functionality of IRS’s automated systems, are complex and will require several more years to fully and effectively address. In addition to the 85 open recommendations from our financial audits and other financial management–related work, there are 88 additional open recommendations stemming from our assessment of IRS’s information security controls over key financial systems, information, and interconnected networks conducted as an integral part of our annual financial audits. The issues that led to our previously reported and our newly identified recommendations related to information security increase the risk of unauthorized disclosure, modification, or destruction of financial and sensitive taxpayer data. Collectively, they constitute IRS’s material weakness in internal control over information security for its financial and tax processing systems. As discussed earlier in this report, recommendations resulting from the information security issues identified in our annual audits of IRS’s financial statements are reported separately because of the sensitive nature of many of these issues. Appendix I presents a combined listing of (1) the 62 non-information- systems security–related recommendations based on our financial statement audits and other financial management–related work that we had not previously reported as closed and the 41 new recommendations based on our fiscal year 2009 financial audit, (2) IRS-reported corrective actions taken or planned as of April 2010, and (3) our analysis of whether the issues that gave rise to the recommendations have been effectively addressed, based primarily on the work performed during our fiscal year 2009 financial statement audit. The appendix lists the recommendations by the date on which the recommendation was made and by report number. Appendix II presents the open recommendations arranged by related material weakness and compliance issue as described in our opinion report on IRS’s financial statements, as well as other control issues we have identified and discussed in our annual management reports to IRS. Linking the open recommendations from our financial audits and other financial management–related work, and the issues that gave rise to them, to internal control activities that are central to IRS’s tax administration responsibilities provides insight regarding their significance. Internal control standards consist of five elements—control environment, risk assessment, control activities, information and communication, and monitoring. For the control activities element, the internal control standards explain that an agency’s system of internal control should provide for an assessment of the risks the agency faces from both external and internal sources and that internal control activities help ensure that management’s directives are carried out. The control activities should be effective and efficient in accomplishing the agency’s control objectives. The control activities element defines 11 specific control activities, which we have grouped into three categories, as shown in table 1. Each of the unresolved recommendations from our financial audits and financial management–related work, and the underlying issues that gave rise to them, can be traced to 1 of the 11 specific control activities as shown in table 1. As table 1 indicates, 19 (22 percent) of the unresolved recommendations relate to IRS’s controls over safeguarding of assets and security activities, 39 (46 percent) relate to issues associated with IRS’s ability to properly record and document transactions, and 27 (32 percent) relate to issues associated with IRS’s management review and oversight. On the following pages, we group the 85 open recommendations under the specific control activity to which the condition that gave rise to them most appropriately fits. We define each control activity as presented in the internal control standards and briefly identify some of the key IRS operations that fall under that control activity. Although not comprehensive, the descriptions are intended to help explain why actions to strengthen these control activities are important for IRS to efficiently and effectively carry out its overall mission. Each control activity description includes a table of the related open recommendations. The tables list the recommendations by the year in which we made them (ID no.). For each recommendation, we also indicate whether it is a short- term or long-term recommendation. We characterized a recommendation as short-term when we believe that IRS had the capability to implement solutions within 2 years of the year in which we first reported them. Given IRS’s mission, the sensitivity of the data it maintains, and its processing of trillions of dollars of tax receipts each year, one of the most important control activities at IRS is the safeguarding of assets. Internal control in this important area should be designed to provide reasonable assurance regarding prevention or prompt detection of unauthorized acquisition, use, or disposition of an agency’s assets. IRS has outstanding recommendations in the following three control activities in the internal control standards that relate to safeguarding of assets (including buildings and equipment as well as tax receipts) and security activities (such as limiting access to only authorized personnel): (1) physical control over vulnerable assets; (2) segregation of duties; and (3) access restrictions to, and accountability for, resources and records. Internal control standard: An agency must establish physical control to secure and safeguard vulnerable assets. Examples include security for and limited access to assets such as cash, securities, inventories, and equipment which might be vulnerable to risk of loss or unauthorized use. Such assets should be periodically counted and compared to control records. Of the trillions of dollars in taxes that IRS collects each year, hundreds of billions is collected in the form of checks and cash accompanied by tax returns and related information. IRS collects taxes both at its own facilities as well as at lockbox banks. IRS acts as custodian for (1) the tax payments it receives until they are deposited in the General Fund of the U.S. Treasury and (2) the tax returns and related information it receives until they are either sent to the Federal Records Center or destroyed. IRS is also charged with controlling many other assets, such as computers and other equipment, but it is IRS’s legal responsibility to safeguard tax returns and the confidential information taxpayers provided on those returns that makes the effectiveness of IRS’s internal controls over physical security essential. While effective physical safeguards over receipts should exist throughout the year, such safeguards are especially important during the peak tax filing season. Each year during the weeks preceding and shortly after April 15, an IRS service center or lockbox bank may receive and process daily over 100,000 pieces of mail containing returns, receipts, or both. The dollar value of receipts each service center and lockbox bank processes increases to hundreds of millions of dollars a day during the April 15 time frame. The following 11 open recommendations in table 2 are designed to improve IRS’s physical controls over vulnerable assets. They include recommendations for IRS to improve controls over (1) physical security at its Taxpayer Assistance Centers (TAC), (2) courier activities, and (3) lockbox banks’ handling of unprocessable items. We consider all of these recommendations to be correctable on a short-term basis. Internal control standard: Key duties and responsibilities need to be divided or segregated among different people to reduce the risk of error or fraud. This should include separating the responsibilities for authorizing transactions, processing and recording them, reviewing the transactions, and handling any related assets. No one individual should control all key aspects of a transaction or event. As noted in the previous section, IRS employees process hundreds of billions of dollars in tax receipts in the form of cash and checks. Consequently, it is critical that IRS maintain appropriate separation of duties to allow for adequate oversight of staff and protection of these vulnerable resources so that no single individual would be in a position of causing an error or irregularity, or potentially converting the asset to personal use, and then concealing it. For example, when an IRS field office receives taxpayer receipts and returns, it is responsible for depositing the cash and checks in a depository institution and forwarding the related taxpayer information received, such as tax returns, to an IRS service center for further processing. In order to adequately safeguard receipts from theft, the person responsible for recording the information from the taxpayer receipts on a voucher should be different from the individual who prepares those receipts for transmittal to the service center for further processing. Also, IRS employees must properly account for the billions of dollars IRS spends each year on its operations. Implementing the following three recommendations in table 3 would help IRS improve its separation of duties, which will in turn strengthen its controls over tax receipts, procurement activities, and financial accounting processes. All are short-term in nature. Internal control standard: Access to resources and records should be limited to authorized individuals, and accountability for their custody and use should be assigned and maintained. Periodic comparison of resources with the recorded accountability should be made to help reduce the risk of errors, fraud, misuse, or unauthorized alteration. Because IRS handles, and is responsible for maintaining accountability over, a large volume of cash and checks, it is imperative that it maintain strong controls to appropriately restrict access to those assets, the records relied on to track those assets, and sensitive taxpayer information. Although IRS has a number of both physical and information systems controls in place, some of the issues we have identified in our financial audits over the years pertain to ensuring that (1) those individuals who have direct access to cash and checks are appropriately vetted, such as through appropriate background investigations, before being granted access to taxpayer receipts and information and (2) IRS maintains effective access security control. The following five short-term recommendations in table 4 were intended to help IRS improve its access restrictions to assets and records. Internal control standard: Internal control and all transactions and other significant events need to be clearly documented, and the documentation should be readily available for examination. The documentation should appear in management directives, administrative policies, or operating manuals and may be in paper or electronic form. All documentation and records should be properly managed and maintained. IRS collects and processes trillions of dollars in taxpayer receipts annually both at its own facilities and at lockbox banks under contract to process taxpayer receipts for the federal government. Therefore, it is important that IRS maintain effective controls to ensure that all documents and records are properly and timely recorded, managed, and maintained both at its facilities and at the lockbox banks. In this regard, it is critical that IRS adequately document and disseminate its procedures to ensure that they are available for IRS employees. IRS must also document its management reviews of controls, such as those regarding refunds and returned checks, credit card purchases, and reviews of TAC operations. To ensure future availability of adequate documentation, IRS must ensure that (1) its systems, particularly those now being developed and implemented, have appropriate capability to identify and trace individual transactions and (2) all critical steps in its accounting processes are adequately documented and controlled. Resolving the following 18 recommendations in table 5 would assist IRS in improving its documentation of transactions and related internal control procedures. Seventeen of these recommendations are short-term, and one is long-term. IRS maintains records for tens of millions of taxpayers in addition to maintaining its own financial records. To carry out this responsibility, IRS often has to rely on outdated computer systems or manual work-arounds. Unfortunately, some of IRS’s recordkeeping difficulties we have reported on over the years will not be addressed until it can replace its aging systems, an effort that is long-term and, in part, dependent on obtaining future funding. Implementation of the following 20 recommendations in table 6 would strengthen IRS’s recordkeeping abilities. Sixteen of these recommendations are short-term, and four are long-term regarding requirements for new systems for maintaining taxpayer records. Several of the recommendations listed deal with financial reporting processes, such as maintaining subsidiary records, recording budgetary transactions, and tracking program costs. Some of the issues that gave rise to several of our recommendations directly affect taxpayers, such as those involving duplicate assessments, errors in calculating and reporting manual interest, errors in calculating penalties, and collection of trust fund recovery penalty assessments. Three of these recommendations have remained open for over 10 years, reflecting the complex nature of the underlying systems issues that must be resolved to fully address some of these control deficiencies. Internal control standard: Transactions and other significant events should be authorized and executed only by persons acting within the scope of their authority. This is the principal means of ensuring that only valid transactions to exchange, transfer, use, or commit resources and other events are initiated or entered into. Authorizations should be clearly communicated to managers and employees. Each year, IRS spends approximately $250 million annually to cover the cost of its employees’ travel. Failure to ensure that employees obtain appropriate authorizations for their travel leaves the government open to fraud, waste, or abuse. IRS actions to address the following short-term recommendation in table 7 would improve IRS’s controls over travel costs. All personnel within IRS have an important role in establishing and maintaining effective internal controls, but IRS’s managers have additional review and oversight responsibilities. Management must set the objectives, put control activities in place, and monitor and evaluate controls to ensure that they are followed. Without adequate monitoring by managers, there is a risk that internal control activities may not be carried out effectively and in a timely manner. IRS has outstanding recommendations in the following four control activities related to effective management review and oversight: (1) reviews by management at the functional or activity level, (2) establishment and review of performance measures and indicators, (3) management of human capital, and (4) top-level reviews of actual performance. Internal control standard: Managers need to compare actual performance to planned or expected results throughout the organization and analyze significant differences. IRS employs over 100,000 full-time and seasonal employees. In addition, as discussed earlier, lockbox banks process tens of thousands of individual receipts, totaling hundreds of billions of dollars for IRS. Management oversight of operations is important at any organization, but is imperative at IRS given its mission. Implementing the following 14 short-term and 1 long-term recommendations in table 8 would improve IRS’s management oversight of several areas of its operations, including monitoring of contractor facilities, release of tax liens, issuance of manual refunds, and use of appropriated funds. These recommendations were made because an internal control activity either did not exist or the existing control was not being adequately or consistently applied. Internal control standard: Activities need to be established to monitor performance measures and indicators. These controls could call for comparisons and assessments relating different sets of data to one another so that analyses of the relationships can be made and appropriate actions taken. Controls should also be aimed at validating the propriety and integrity of both organizational and individual performance measures and indicators. IRS’s operations include a vast array of activities encompassing educating taxpayers, processing of taxpayer receipts and data, disbursing hundreds of billions of dollars in refunds to millions of taxpayers, maintaining extensive information on tens of millions of taxpayers, and seeking collection from individuals and businesses that fail to comply with the nation’s tax laws. Within its compliance function, IRS has numerous activities, including identifying businesses and individuals that underreport income, collecting from taxpayers who do not pay taxes, and collecting from those receiving refunds for which they are not entitled. Although IRS has at its peak over 100,000 employees, it still faces resource constraints in attempting to fulfill its duties. It is vitally important for IRS to have sound performance measures to assist it in assessing its performance and targeting its resources to maximize the government’s return on investment. However, in past audits we have reported that IRS did not capture costs at the program or activity level to assist in developing cost-based performance measures for its various programs and activities. As a result, IRS is unable to measure the costs and benefits of its various collection and enforcement efforts to best target its available resources. The following one short-term and two long-term recommendations in table 9 are designed to assist IRS in (1) evaluating its operations, (2) determining which activities are the most beneficial, and (3) establishing a good system for oversight. These recommendations are directed at improving IRS’s ability to measure, track, and evaluate the costs, benefits, or outcomes of its operations—particularly with regard to identifying its most cost-effective tax collection activities. Internal control standard: Effective management of an organization’s workforce—its human capital—is essential to achieving results and an important part of internal control. Management should view human capital as an asset rather than a cost. Only when the right personnel for the job are on board and are provided the right training, tools, structure, incentives, and responsibilities is operational success possible. Management should ensure that skill needs are continually assessed and that the organization is able to obtain a workforce that has the required skills that match those necessary to achieve organizational goals. Training should be aimed at developing and retaining employee skill levels to meet changing organizational needs. Qualified and continuous supervision should be provided to ensure that internal control objectives are achieved. Performance evaluation and feedback, supplemented by an effective reward system, should be designed to help employees understand the connection between their performance and the organization’s success. As a part of its human capital planning, management should also consider how best to retain valuable employees, plan for their eventual succession, and ensure continuity of needed skills and abilities. IRS’s operations cover a wide range of technical activities requiring specific expertise needed in tax-related matters; financial management; and systems design, development, and maintenance. Because IRS has tens of thousands of employees spread throughout the country, it is imperative that management keep its guidance up-to-date and its staff properly trained. Taking action to implement the following eight short-term recommendations in table 10 would assist IRS in its management of human capital. Internal control standard: Management should track major agency achievements and compare these to the plans, goals, and objectives established under the Government Performance and Results Act. IRS is responsible for developing and operating a system of internal control to ensure that it spends the billions of dollars appropriated to it each year for operations in accordance with the directions dictated by Congress. Implementing the following short-term recommendation in table 11 would improve IRS’s management and oversight of its performance against legal mandates and requirements. Increased budgetary pressures and an increased public awareness of the importance of internal control require IRS to carry out its mission more efficiently and more effectively while protecting taxpayers’ information. Sound financial management and effective internal controls are essential if IRS is to efficiently and effectively achieve its goals. IRS has made substantial progress in improving its financial management and internal control since its first financial audit, as evidenced by unqualified audit opinions on its financial statements for the past 10 years; resolution of several material internal control weaknesses, significant deficiencies, and other control issues; and actions taken resulting in the closure of hundreds of financial management recommendations. This progress has been the result of hard work by many individuals throughout IRS and sustained commitment of IRS leadership. Nonetheless, more needs to be done to fully address the agency’s continuing financial management challenges—resolving material internal control weaknesses; developing outcome-oriented performance metrics that can facilitate managing operations for outcomes; and correcting numerous other internal control issues. Effective implementation of the recommendations we have made and continue to make through our financial audits and related work could greatly assist IRS in improving its internal controls and achieving sound financial management. While we recognize that some actions—primarily those related to modernizing automated systems—will take a number of years to resolve, most of the open recommendations can be addressed in the short term. In commenting on a draft of this report, IRS expressed it’s appreciation for our acknowledgment of the agency’s progress in addressing its financial management challenges as evidenced by our closure of 18 open financial management recommendations from prior GAO reports. IRS also commented that it is committed to implementing appropriate improvement to ensure that it maintains sound financial management practices. We will review the effectiveness of further corrective actions IRS has taken or will take to address all open recommendations as part of our audit of IRS’s fiscal year 2010 financial statements. We are sending copies of this report to the Chairmen and Ranking Members of the Senate Committee on Appropriations; Senate Committee on Finance; Senate Committee on Homeland Security and Governmental Affairs; and Subcommittee on Taxation, IRS Oversight and Long-Term Growth, Senate Committee on Finance. We are also sending copies to the Chairmen and Ranking Members of the House Committee on Appropriations; House Committee on Ways and Means; the Chairman and Vice Chairman of the Joint Committee on Taxation; the Secretary of the Treasury; the Director of OMB; the Chairman of the IRS Oversight Board; and other interested parties. The report is also available at no charge on the GAO Web site at http://www.gao.gov. If you or your staffs have any questions concerning this report, please contact me at (202) 512-3406 or sebastians@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix IV. This appendix presents a list of (1) the 62 recommendations that we had not previously reported as closed, (2) Internal Revenue Service (IRS) reported corrective actions taken or planned as of April 2010, and (3) our analysis of whether the issues that gave rise to the recommendations have been effectively addressed. It also includes 41 recommendations based on our fiscal year 2009 financial statement audit. The appendix lists the recommendations by the year and recommendation number (ID no.) and also identifies the report in which the recommendation was made. For several years, we have reported material weaknesses, significant deficiencies, noncompliance with laws and regulations, and other control issues in our annual financial statement audits and related management reports. Appendix II provides summary information regarding the primary issue to which each open recommendation is most closely related. To compile this summary, we analyzed the nature of the open recommendations to relate them to the material weaknesses, compliance issue, and other control issues not associated with a material weakness identified as part of our financial statement audit. The Internal Revenue Service (IRS) has serious internal control issues that affected its management of unpaid tax assessments. Specifically, IRS (1) reported balances for taxes receivable and other unpaid assessments that were not supported by its core general ledger system for tax administration, (2) lacked a subsidiary ledger for unpaid tax assessments that would allow it to produce accurate, useful, and timely information with which to manage and report externally, and (3) experienced errors and delays in recording taxpayer information, payments, and other activities. Serious weaknesses in IRS’s internal control over information security continue to jeopardize the confidentiality, availability, and integrity of information processed by IRS’s key systems, increasing the risk of material misstatement for financial reporting. For example, IRS has not restricted users’ ability to bypass application controls, removed separated employees’ systems access in a timely manner, or restricted system access to only those who needed it. These unresolved weaknesses increase the risk that data processed by the agency’s financial management systems are not reliable. Although IRS has made some progress in addressing previous weaknesses we identified in its information systems and physical security controls, as of March 2010, there were 88 open recommendations designed to help IRS improve its information systems security controls. Those recommendations are reported separately and are not included in this report primarily because of the sensitive nature of some of the issues. IRS continues to be noncompliant with the laws and regulations governing the release of federal tax liens. IRS did not always release applicable federal tax liens within 30 days of tax liabilities being either paid off or abated, as required by the Internal Revenue Code (section 6325). The Internal Revenue Code grants IRS the power to file a lien against the property of any taxpayer who neglects or refuses to pay all assessed federal taxes. The lien serves to protect the interest of the federal government and as a public notice to current and potential creditors of the government’s interest in the taxpayer’s property. The 70 recommendations listed below pertain to issues that do not rise individually or in the aggregate to the level of a material weakness or noncompliance with laws and regulations. However, these issues do represent weaknesses in various aspects of IRS’s control environment that should be addressed. In addition to the contact named above, the following individuals made major contributions to this report: William J. Cordrey, Assistant Director; Russell Brown; Ray B. Bush; Nina Crocker; Oliver Culley; Doreen Eng; Charles Fox; Valerie Freeman; Jamie Haynes; Ted Hu; Richard Larsen; Delores Lee; Julie Phillips; John Sawyer; Christopher Spain; Cynthia Teddleton; LaDonna Towler; and Gary Wiggins.

Summary: In its role as the nation's tax collector, the Internal Revenue Service (IRS) has a demanding responsibility to annually collect trillions of dollars in taxes, process hundreds of millions of tax and information returns, and enforce the nation's tax laws. Since its first audit of IRS's financial statements in fiscal year 1992, GAO has identified a number of weaknesses in IRS's financial management operations. In related reports, GAO has recommended corrective actions to address those weaknesses. Each year, as part of the annual audit of IRS's financial statements, GAO makes recommendations to address any new weaknesses identified and follows up on the status of IRS's efforts to address the weaknesses GAO identified in previous years' audits. The purpose of this report is to (1) provide an overview of the financial management challenges still facing IRS, (2) provide the status of financial audit and financial management-related recommendations and the actions needed to address them, and (3) highlight the relationship between GAO's recommendations and internal control activities central to IRS's mission and goals. IRS has made progress in improving its internal controls and financial management since its first financial statement audit in 1992, as evidenced by 10 consecutive years of clean audit opinions on its financial statements, the resolution of several material internal control weaknesses, and actions resulting in the closure of over 250 financial management recommendations. This progress has been the result of hard work throughout IRS and sustained commitment at the top levels of the agency. However, IRS still faces significant financial management challenges in (1) resolving its remaining material weaknesses in internal control, (2) developing outcome-oriented performance metrics, and (3) correcting numerous other internal control issues, especially those relating to safeguarding tax receipts and taxpayer information. At the beginning of GAO's audit of IRS's fiscal year 2009 financial statements, 62 financial management-related recommendations from prior audits remained open because IRS had not fully addressed the issues that gave rise to them. During the fiscal year 2009 financial audit, IRS took actions that GAO considered sufficient to close 18 recommendations. At the same time, GAO identified additional internal control issues resulting in 41 new recommendations. In total, 85 recommendations remain open. To assist IRS in evaluating and improving internal controls, GAO categorized the 85 open recommendations by various internal control activities, which, in turn, were grouped into three broad control categories: safeguarding of assets and security activities; proper recording and documenting of transactions; and effective management review and oversight. The continued existence of internal control weaknesses that gave rise to these recommendations represents a serious obstacle that IRS needs to overcome. Effective implementation of GAO's recommendations can greatly assist IRS in improving its internal controls and achieving sound financial management and can help enable it to more effectively carry out its tax administration responsibilities. Most can be addressed in the short term (the next 2 years). However, a few recommendations, particularly those concerning the functionality of IRS's automated systems, are complex and will require several more years to effectively address. GAO is not making any recommendations in this report. In commenting on a draft report, IRS stated that it is committed to implementing appropriate improvements to maintain sound financial management practices.