W&I supports IRS’s mission by maintaining an enforcement presence and encouraging the correct reporting of income tax to instill the highest degree of public confidence in the tax system’s integrity, fairness, and efficiency. Audit programs in W&I cover mainly refundable credits on the Form 1040 U.S. Individual Income Tax Return. All W&I’s audits are correspondence audits—a type of audit conducted through the mail. Audits have two compliance effects. First, they directly detect and correct noncompliance by the audited taxpayers. Second, audits indirectly encourage nonaudited taxpayers to comply voluntarily. W&I’s audit responsibilities generally concern refundable credits claimed on individual income tax returns. A refundable credit can give taxpayers a refund even if they owe no tax and are not otherwise required to file a tax return. Nonrefundable credits also can reduce taxpayers’ tax, but any excess is not refunded. The most common refundable credit that W&I audits is the Earned Income Tax Credit (EITC), which is a benefit for working people with low to moderate income. EITC will cost an estimated $58 billion in federal outlays in fiscal year 2016, according to the Office of Management and Budget (OMB). IRS measures noncompliance in claiming EITC and also uses those measures to estimate its portion of federal improper payments. EITC was the second biggest contributor to the federal government’s estimated $124.7 billion in improper payments in fiscal year 2014. Specifically, EITC accounted for an estimated $17.7 billion in improper payments, which is approximately 27 percent of its outlays during fiscal year 2014. OMB has established guidance for federal agencies on reporting, reducing, and recovering improper payments as required by the Improper Payments Information Act of 2002, as amended. Other refundable credits that W&I covers include the Additional Child Tax Credit, American Opportunity Tax Credit, and Premium Tax Credit. IRS also operates other compliance programs that may lead to tax returns being referred to the audit function but are not audit programs. Examples of these programs include the following. The math error program corrects certain obvious errors on tax returns at the time they are filed, such as claiming a credit above the allowed income threshold. The Automated Underreporter program matches income data reported on a tax return with third-party information about income and expenses provided to IRS by employers and financial institutions. Mismatches can result in IRS asking the taxpayer to successfully explain the discrepancy or pay additional tax. The nonfiler program uses third-party information to identify people who do not file a required tax return. Some nonfiler cases may be forwarded for audit, according to IRS officials. The unallowables program identifies items reported on a tax return that are specifically disallowed by law or rule and result in the tax return not being accepted by IRS. These can include taxpayers’ claims of deductions, items exceeding statutory limits, or items not supported by the proper information or schedule. In November 2014, IRS realigned its tax compliance organizations that served individual and small business taxpayers to improve efficiency and identify emerging compliance issues more quickly, as well as streamline decision making and resources in audit and collection while avoiding duplication. The realignment changed what the W&I and Small Business and Self-Employed (SB/SE) divisions audit. W&I kept work focused on EITC. Most post-refund discretionary programs moved from W&I to SB/SE except EITC post-refund work. Under the realignment, W&I also took on new responsibilities, such as certain audits of returns reporting income on Schedule C Profit or Loss from Business. W&I’s audit programs are managed out of an office called Return Integrity and Compliance Services (RICS), which operates three other offices that directly or indirectly review tax return data for potential audits. These other three offices include: Refundable Credits Policy and Program Management (RCPPM); Deputy Director’s Return Integrity, and Compliance Services; and Refundable Credits Examination Operations. Figure 1 shows how RICS’s audit offices are connected to the W&I Commissioner’s office in W&I’s organization. RCPPM: This office oversees refundable credit enforcement and establishes filters for computerized selection of returns for audit. The main tools RCPPM uses for selecting returns for audit are filters from the Dependent Database (DDb). These filters identify returns and use risk- based scoring to select the returns. DDb creates the scores after W&I enters tax return data but before refunds are issued. Some of the rules/criteria include the use of taxpayer’s dependent information, such as related children data, qualifying children claimed with multiple taxpayers, birth parents, and birth parents’ Social Security numbers and dates of birth. If information from a tax return creates a high enough score, the return may be made available for audit in Refundable Credits Examination Operations. If the return is audited, letters will systemically be issued to the taxpayers asking them to explain an issue on the tax return. W&I holds an annual 3-day working session to set and evaluate the effectiveness of its DDb filters for selecting returns for possible audit. W&I conducts analyses throughout the year in support of this meeting, which includes W&I research, the Information Technology (IT) Office, and RICS. The May 2015 working session included more than two dozen officials, including two executives. The officials review new laws and audit results to help evaluate the effectiveness of the business rules. An example of a law that W&I discussed during its annual working session included the Patient Protection and Affordable Care Act, which created the Premium Tax Credit. Audit results that the officials also consider during the meeting include no-change rates, defined as the proportion of audits that resulted in no changes to the assessed tax amount for the tax return). Modifications to the selection criteria are incorporated into a unified work request for W&I’s IT Office. The request is reviewed and approved by the Business Modernization Office, IT, and stakeholder division executives before programming is done to incorporate the new criteria. Deputy Director’s RICS office: This office operates the Integrity and Verification Operations (IVO), which is not an audit program, but may refer returns with refundable credits for audit. IVO uses several computer systems, including DDb, to identify fraud and refund abuse across many types of taxes, including refundable credits. W&I annually reviews tolerances that IVO uses to search tax return data for potential fraud, abuse, or other noncompliance. IVO also has a program that processes leads from external stakeholder partners, such as financial institutions, state agencies, or other third parties. This program focuses on stopping fraudulent refunds from issuing and/or recovering fraudulent refunds that were issued and are identified via external sources. Refundable Credits Examination Operations: The Refundable Credits Examination Operations office performs classification duties and conducts audits. Classification is the process of determining whether a return has potential noncompliance worth auditing and what issues should be audited. The criteria that classifiers use to decide what issues should be sent for audit are listed in IRM 4.1.5 and 4.19.11. In W&I, classification is conducted on Form 1040x Amended Return submissions or returns that were referred from other parts of IRS. The returns referred from other parts of IRS that W&I classifies generally do not meet existing DDb criteria for return selection or were amended returns submitted to IRS on paper. Referrals from other business units are one of IRS’s priority audit categories, which also includes new employee audits and mandatory work, such as nationally coordinated research projects. Once a classifier classifies the return and identifies the issues, the letter is generated and the audit is started. This inventory is not assigned to an auditor until correspondence is received. In some cases, W&I classifiers may send a return to another business unit, such as SB/SE. W&I also classifies returns filed with an Individual Tax Identification Number (ITIN) to check for tax noncompliance. For example, returns that are filed with an ITIN and that meet audit referral criteria for the refundable Additional Child Tax Credit are set aside for classification. In fiscal year 2014, DDb selected 59 percent of W&I’s audit inventory, as shown in figure 2. The next largest source of audits was referrals from IVO. Manual classification of ITIN and amended returns, as well as other referrals, together accounted for a relatively smaller fraction of the overall number of W&I audits in fiscal year 2014—meaning that most W&I case selection was computer driven. W&I audits resulted in $2.5 billion in recommended additional tax in fiscal year 2014, down from $3.3 billion in fiscal year 2013. W&I also had $49 million and $69 million in revenue protection in 2014 and 2013 respectively. IRS did not have reliable data to analyze the number of audits or assessments in prior years. However, these totals include audits of issues that W&I is no longer responsible for addressing, such as referrals from state agencies. IRS officials told us that they did not have reliable data for the most recent fiscal year at the time of our audit. In addition to setting criteria for automated systems to apply to tax return data, managers at W&I’s headquarters set the number of audit starts at the beginning of the fiscal year and make weekly adjustments in the number of returns selected for audit that will be worked by audit staff. Because IRS does not audit every return identified by the automated systems, this workload management is a form of audit selection. The tool that W&I officials use to manage the audit starts is the work plan, a spreadsheet with the projected number of audits by type of tax that W&I managers write before cases are selected at the beginning of the fiscal year. Audit managers use the spreadsheet to allocate returns audit starts based on the goals W&I has set for closing cases, work already in process, and the available number of auditors. Auditors then generally work returns on a first in, first out basis. At the end of fiscal year 2015, W&I reported having 683 tax examiners of which about 584 conducted correspondence audits and the others did support work, including taxpayers’ requests to reconsider previous audit findings. W&I also reported having 47 tax compliance officers. In developing the work plan, W&I managers said they also take overall compliance strategies for specific refundable credits into account that include audit as one component. Figure 3 shows where RICS’s audit processes operate in a simplified illustration of return processing. Beyond available resources, another measure that W&I officials say they use to review their audit selection methods is the no-change rate. As an example, W&I requested changing criteria on qualifying children for EITC reviews for fiscal year 2015 to reduce no-change rates. Audits that end with no change to the reported tax assessment on the return impose burdens on compliant taxpayers. W&I officials also said a low no-change rate reflects more efficient use of IRS resources. IRS officials said they calculated W&I’s overall no-change rate as 10.1 percent for work compiled through September of fiscal year 2015, with the no-change rate specifically for DDb selections under the realignment as 12.5 percent. Implementation of an effective internal control system can improve accountability in achieving an entity’s mission. As set forth in Standards for Internal Control in the Federal Government, internal control is a major part of managing an organization as it comprises the plans, methods, and procedures used to meet missions, goals, and objectives, which support performance-based management. In addition, internal controls help agency program managers achieve desired results and provide reasonable assurance through the effectiveness and efficiency of operations, among other things. Further, internal control is not one singular event, but a series of actions and activities that occur throughout an entity’s operations and on an ongoing basis. Examples of internal controls include establishing clear, consistent agency objectives, documenting significant events, and ongoing monitoring. While W&I has documented how some of its procedures meet the internal control standards, we found some potential issues that increase the risk that W&I audit selection activities may not fully contribute to its mission to treat all taxpayers fairly and with integrity. Internal control standards require that management and employees establish and maintain a positive and supportive environment toward internal control and conscientious management. Several key factors affect the control environment such as ethical values maintained and demonstrated by management and staff, management’s philosophy towards performance-based management, and delegation of authority and responsibility, among others. We found several IRS procedures that demonstrated some factors of a positive environment for promoting internal controls. First, IRS’s IRM includes various ethics guidance for all staff. For example, IRM cross- references federal and IRS agency ethics regulations that include 14 principles of ethical conduct, such as conflicts of interest and political activities of staff. IRS requires all managers to hold an annual ethics discussion with their staff and all IRS staff to certify that they attended the discussion. While the code of conduct does not specifically address audit selection, IRS provided sufficient documentation to demonstrate that staff should be aware of the need to act ethically when conducting their duties—such as by not letting personal biases affect audit selection. In addition, W&I officials stated that they were not aware of any staff responsible for audit selection violating the code of conduct. Second, IRS staff are rated annually on their performance, including whether they met the retention standard for the fair and equitable treatment of taxpayers. IRM requires supervisors to brief staff on what types of behaviors would meet or not meet the standard. For instance, if a staff member’s communications with taxpayers are professional and courteous and accurately state the facts, the standard would be met. While the performance appraisal criteria do not specifically address fairness for audit selection, IRS has documentation to demonstrate that staff should conduct their duties according to the standard. Third, W&I has clearly assigned authority and responsibility for its audit selection processes. W&I demonstrated this by providing a list of (1) IRS stakeholders who participated in W&I’s annual meetings to discuss any revisions to audit selection criteria for fiscal year 2015, 2) program analysts involved in modifying audit selection rules, and 3) Submissions Processing staff tasked with referring returns that meet certain criteria to staff classifying tax returns, such as amended individual tax returns that include certain tax credits. In addition, staff who are responsible for modifying audit selection criteria do not audit returns. Similarly, staff who classify a return cannot audit that return. Fourth, staff that manually classify amended returns for potential audit are to receive training to help them maintain a level of competence necessary for assigned duties. Other IRS staff responsible for revising W&I criteria used in automated programs do not receive any formal training in revising the criteria. W&I officials told us they believed that most of these staff are well versed and proficient in their respective areas of tax law because they are either IRS executives or senior managers with at least 20 years of experience. They said that such staff have had years of related training in specialized areas for their former positions (e.g., revenue agents and department managers) and use their experience as well as feedback from W&I staff involved in the audits, research data, and audit results to help inform their decision in revising audit selection criteria. Internal control standards call for specific terms to be clearly defined and set forth so they can be easily understood. Management should define program objectives that align with an entity’s mission, strategic plan, goals, and requirements of applicable laws and regulations. Clearly defined objectives can enhance program effectiveness and efficiency. Documenting objectives allow agency officials and staff to have a consistent understanding of the organization’s purpose. Internal control standard: define objectives Program objectives are to be clearly defined in measurable terms to enable the design of internal control. Specific terms should be fully defined and clearly set forth so they can be easily understood at all levels of the organization. W&I has not clearly defined, documented, or communicated key terms. For example, while the concepts of “fairness” and “integrity” are highlighted in IRS’s mission and policy statements and W&I’s mission statement, W&I has not defined or documented fairness and integrity, particularly for audit selection. As a result, each staff member is left to define these terms. W&I officials shared views on how fairness and integrity might be defined for audit selection. For fairness, a senior W&I official informally defined it as having a low no-change rate and incorporating eligibility requirements as outlined by the Internal Revenue Code or other legislation into audit selection criteria. In addition, W&I officials said they believed that W&I’s audit selection process is fair because all individual tax returns that run through DDb are scored by the same audit selection criteria. Further, Submissions Processing staff apply audit criteria for all amended returns, which may require classification by classifiers if they are flagged for potential audit. For integrity, W&I officials highlighted all of IRS’s six core values, including honesty and integrity, which focuses on upholding “the public trust” and being “honest and forthright in all internal and external dealings.” However, they did not indicate how they know integrity is provided in audit selection. As a result, by not communicating a clear definition of fairness and integrity to all staff involved in audit selection, W&I is vulnerable to inconsistent selections. In addition, W&I has not established program-level objectives on the selection of returns for audit that support its and IRS’s shared mission of applying the tax law with integrity and fairness to all. Rather, W&I has four broad audit goals, including: measuring the degree of voluntary compliance on filed returns; making quality contacts to determine the correct taxable amount. reducing noncompliance by identifying and cost-effectively allocating resources to those returns most in need of audit; conducting timely and quality audits of tax returns; and These audit goals do not refer to fairness and integrity because these terms have not been defined by IRS or W&I. W&I officials confirmed that they do not have program-level objectives for how returns are selected. However, W&I has developed fiscal year 2016 activities for its annual operations plan that has references to potential objectives. For instance, one of RCPPM’s action item focuses on RICS reviewing and creating workload selection filters intended to ensure fairness and integrity, running all individual tax returns against such filters, and pursuing audits with high probable changes with the intent of reducing no-change rates. Internal control standards also require management to establish activities to monitor performance measures and indicators. Performance measures and targets are used to compare actual results to planned performance. Without clearly defined program-level objectives on its audit selection process, W&I cannot measure whether its selection criteria are meeting its mission of applying the tax law with fairness and integrity. Existing performance measures focus on audit results rather than audit selection. W&I officials stated that the no-change rate could be viewed as a performance measure to evaluate whether W&I was meeting its mission of applying the tax law with integrity and fairness to all. W&I’s stated goal is to decrease the no-change rate to assure that the right taxpayers are claiming a credit, for example, based on its selection criteria. W&I officials stated that they use different no-change rates by issue type, such as the Earned Income Tax Credit, and strive to keep them as low as possible. However, W&I has not created indicators to evaluate what no-change rate is good or bad, or what rate would indicate fair selections. We reported in June 2014 that IRS did not document criteria on how its managers were to use performance data, such as the no-change rate, or to make program decisions, such as the number of audits or tax issues to audit. Internal control standards state that management needs to identify and analyze relevant internal and external risks, and then decide how to manage those risks; a precondition to risk assessment is the establishment of clear program objectives. The first and most critical step of risk assessment is risk identification. Management should have well- documented procedures for regularly identifying internal and external risks to program objectives and procedures, such as in short- and long- term forecasting and strategic planning. Because W&I does not have clearly formulated and communicated program objectives for audit selection, W&I cannot fully implement a process to identify potential risks in its audit selection process. Without risk identification and assessments linked to program objectives, vulnerabilities may go unaddressed, resulting in unfair case selection, decreased dollars collected, greater noncompliance, or other negative program effects. Additionally, W&I does not have reasonable assurance that it is appropriately assessing risk in its audit selection process in two areas in which W&I officials believe the risks are low. First, W&I officials said that they do not think certain internal control elements related to risk assessment—such as downsizing operations or changing operating processes—affect the audit selection process; however the federal internal control tool views these factors as applicable. Second, IRS had identified no risk of bias for automated audit selection programs because the programs compare data on a taxpayer’s return with third-party data. Robust internal controls to address risks that threaten the automated selection criteria are especially important because automated programs select the majority of returns that W&I audits. IRS is implementing an Enterprise Risk Management (ERM) program to consider risks more systematically across IRS. As we recently reported, IRS implemented ERM, among other reasons, to serve as an early- warning system to identify and address emerging challenges and address them before they affect operations. According to IRS’s Chief Risk Officer, the goal is to embed risk management principles and practices into the daily operations of the business units and integrate long-standing processes into the new, more holistic ERM approach. Since the implementation of the ERM process is ongoing, it is too early to determine the effectiveness of ERM in identifying and managing risk. ERM is intended to help organizations in setting strategy to consider risk and how much risk the organization is willing to accept. According to IRS officials, ERM is broader in scope than internal controls, focusing on agency-wide risks. It is important for agencies to assess risk at both the agency-wide and the program level. We found that IRS has various procedures that convey the importance of internal controls at the managerial level, such as IRM guidance on monitoring internal controls, an annual managerial self-assessment of adherence to internal controls, and a classification quality review process. To the extent that managers report deficiencies and W&I uses the results, the annual self-assessment of IRS’s internal controls can provide assurance that the importance of internal controls is understood at the managerial level. W&I officials provided an example of a completed fiscal year 2014 self-assessment that included a manager’s sign-off of a reasonable assurance that IRS’s controls are effective and operating as intended. However, beyond “yes” and “not applicable” responses, the documentation did not provide any detailed responses on the internal controls assessed and their relationship to the audit selection process. In response to how internal control responsibilities were communicated to all staff, including non-managers, W&I officials stated that internal controls are built into their processes, such as the annual meetings, staffing designations and tasks, automated systems, risk identification and assessments, and monitoring. In addition, they said that the annual self-assessment process requires managers to certify that the operations and staff they manage are in compliance with internal controls. The fiscal year 2014 self-assessment includes a question regarding whether managers communicated policies on a routine basis that enabled staff to meet and understand their internal control and other responsibilities effectively. Beyond a “yes” response by one of W&I’s managers, IRS did not provide evidence that W&I directly assigned and communicated internal control responsibilities to non-managers, such as program analysts and classifiers who are tasked with revising or applying audit selection criteria, respectively. By not relaying information on internal control responsibilities to all employees, W&I has less assurance that its employees understand internal controls and increases the risk of not being aware of potential internal control issues that could result in unfair audit selection. Internal control standard: control activities for information systems Access security control protects the systems and network from inappropriate access and unauthorized use. Application control is designed to help ensure completeness, accuracy, authorization, and validity of all transactions during application processing. Federal internal control standards require a variety of control activities for information processing, such as controlling access to data, files, and programs. In addition, access to resources should be limited to authorized individuals, and accountability for their use should be assigned and maintained. Access rights are used to implement security policies that determine what a user can do after being allowed into the system, such as allowing the user to read or write to a certain file or directory. Maintaining access rights is an important aspect of administering system security. In addition to access controls, other controls should be in place to ensure the integrity of an organization’s information. These controls can include, but are not limited to, policies, procedures, and techniques for securely configuring information systems with software updates. We found IRM guidance that specifies procedures to restrict access to authorized users as well as various software testing mechanisms. Specifically, IRM sections on information technology (IT) security documented access to data, files, and programs for modifying IT systems, including those that cover W&I’s audit selection criteria. For example, IRS uses a process to register all users for access to any IRS IT resource when their access is authorized by the user’s manager. By obtaining such access, IT programmers can utilize the official change management system to add new or modify W&I audit selection criteria that are based on the unified work request that is approved by IRS management. However, we reported in March 2015 that IRS had not updated the security authorization for IRS’s access request and approval system to reflect significant changes made to the operating environment. As a result, we recommended that IRS update the security authorization for the access request as well as the approval system to reflect the significant changes to the operating environment. In response to this recommendation, IRS agreed to provide corrective action plans where appropriate. In addition, the Tax Inspector General for Tax Administration (TIGTA) has an ongoing audit related to the request and approval process in obtaining access to IRS systems. IRM has a section on testing procedures to ensure accurate revisions are made, such as modifying W&I’s audit selection criteria. IT officials also provided other guidance, such as the IT Test Reference Guide, to address how new or revised software is to be thoroughly tested and approved. IT officials provided examples of output reports to show how DDb modifications to W&I audit selection criteria were tested, approved, and working as designed. Internal control standards state that documentation should clearly identify procedures and should allow agency officials and staff to understand the purpose of internal control procedures and be readily available for audit. Documenting procedures is evidence that the right controls are identified and that those procedures are capable of being communicated to those responsible for their performance, and capable of being monitored and evaluated. Internal control standard: document controls to address risks to program objectives Procedures should be clearly documented to ensure that management's plans, policies, and procedures are sufficiently and fully carried out. IRS has documented some agency-wide policies to support internal controls, but these are not always linked to W&I’s audit selection process. For example, as noted previously, IRS provided sufficient documentation to demonstrate that staff should be aware of the need to act ethically when conducting their duties, such as not letting personal biases affect their work (e.g. selecting returns for audit). Other IRS policies—including the retention standard—reference the fair and equitable treatment of taxpayers in general, but do not consistently reference audit selection in particular. We also found some weaknesses in documenting parts of the audit selection plan. W&I has workload selection templates that describe the methods that IRS uses to identify and select tax returns for audit. The templates are intended to explain how W&I determined, tested, and approved the steps involved in each method, as well as what types of staff and functions are involved. While some elements of the selection process are described in detail in the workload selection templates, not all elements of the selection process—ranging from determining audit potential to inter-office interactions—are covered. For example, one workload selection template notes that returns with the highest audit potential are marked, but it does not describe how audit potential is determined. Additionally, the workload selection templates do not describe how the systems and processes described in the templates are related. For example, W&I lacks clear documentation about how the three offices which select the majority of returns W&I audits—Refundable Credits Policy and Program Management; the Deputy Director’s Return Integrity, and Compliance Services; and Refundable Credits Examination Operations—interact with one another. The lack of comprehensive documentation to describe W&I’s audit selection process results in less assurance that these processes effectively address risks. Additionally, the absence of a fully documented selection process may make it difficult for W&I to defend against accusations that it is not appropriately following its processes and procedures, since the incomplete documentation makes it difficult to clearly communicate about how audit selection works. Internal control standard: monitor controls Internal control design should assure that ongoing monitoring of controls occurs in the course of normal operations. According to internal control standards, program managers should have a strategy and establish procedures for ongoing monitoring to assure the effectiveness of its control activities, and that deficiencies found during separate evaluations should be resolved in a timely manner. Monitoring involves management assessing the design and operational effectiveness of internal control systems as well as ensuring that corrective actions are effectively implemented in a timely manner. Serious deficiencies and internal control problems should be reported to top management in a timely manner. Managers and supervisors should know their responsibilities for internal control and the need to make control and control monitoring part of their regular operating processes. While W&I’s policy is clear that internal control issues should be reported to the next level of management, the mechanism to elevate potential internal control issues to management is limited. The IRM states that a problem in the design or operation of an internal control should be reported to the next level of management as a significant deficiency. It does not, however, specify how non-managers should report it or that it should be reported in a timely manner. The form that W&I staff would use to report such deficiencies in the automated filters used for return selection—the Compliance Data Environment Production Filter Modification Approval form—includes space for submitting modification requests for the automated filters, but not for reporting internal control deficiencies that do not have a proposed solution. The form also states that the reason for modification should be self-explanatory, which may not appropriately highlight the deficiency the modification seeks to address. W&I officials said that IRS has no guidance beyond the instructions on the form to report deficiencies and that no deficiencies have been identified with this form. W&I officials subsequently identified general ways in which staff could report internal control deficiencies. They said that staff can send e-mails directly to the Commissioner, submit help desk tickets for IT issues, provide feedback during a regularly-scheduled forum, make a submission to the “I suggest” program to improve a program or process, or supply feedback on IRM sections. When asked to provide examples of employees elevating potential internal control issues, W&I officials also provided examples of internal control issues identified during the monitoring process. This limitation in the reporting mechanism—including the limited examples of staff reporting deficiencies—increases the risk that W&I would not know about a potential deficiency that staff perceive or experience. Without a clear means of elevating possible internal control deficiencies to top management in a timely manner, W&I does not have reasonable assurance that concerns noticed by an employee are reported appropriately or in a timely manner. In addition, we found some limitations in the timeliness of W&I’s monitoring. W&I officials said that, at the beginning of each filing season, a team made up of experienced analysts and managers reviews selections and notices generated from the new programming to ensure programming is working as intended, and that the generated notices are correct. They also said that they continuously monitor audit selections and results to ensure that implemented corrective actions were appropriate. However, the documentation indicates that it is an annual—rather than continuous—review as part of W&I’s annual 3-day working session that included evaluating the effectiveness of its criteria for selecting returns for possible audit. Further, W&I did not clearly document what corrective actions, if any, were taken and how they were implemented in response to the deficiencies it identified at the annual working session. W&I officials provided documentation of issues identified with the Premium Tax Credit; however, the deadlines for actions items were all at least 6 months past, and W&I did not provide support that those changes were appropriately implemented. Because of this, W&I lacks reasonable assurance that the issues were addressed in an appropriate or timely manner and that they have been sufficiently resolved. Without ensuring that it has sufficient controls to identify deficiencies and take necessary corrective action, W&I may be missing opportunities to ensure that the changes work as intended and lower the risk of selecting audits unfairly. W&I auditors have interacted with hundreds of thousands of taxpayers and assessed billions of dollars in tax changes, making W&I’s mission of applying the tax law with fairness and integrity all the more critical. Failure to accomplish that mission could undermine the public’s confidence in the tax system, waste resources, and burden taxpayers. Properly designed and maintained internal controls for audit selection can help W&I better assure its mission. While we found that W&I had implemented some internal controls over its array of audit selection processes, we also identified a series of internal control weaknesses that reduce the assurance that current or future audit. Most importantly, IRS lacks clearly defined and documented program- level objectives, performance measures, indicators, and definitions of key concepts such as fairness, reducing the assurance that W&I employees are treating taxpayers equally. Without defining, documenting, and communicating to staff these aspects of internal control, IRS cannot know whether it is meeting its and W&I’s shared mission of applying the tax law with fairness and integrity to all taxpayers. W&I’s use of the no-change rate could be viewed as a performance measure, but it is not sufficient to assure that the audit selection criteria are fair. Having program-level objectives, performance measures, indicators, and definitions that link to its mission and goals would enhance W&I’s ability assure that its audit selection processes are fair and have integrity. Having program-level objectives for audit selection in place is a precondition to developing a risk assessment strategy for audit selection, which W&I has not adopted. With an effective risk assessment strategy for audit selection, W&I could gauge potential internal and external risks that may hinder its ability to meet its mission of treating taxpayers fairly and equally. Such a strategy would increase the assurance that W&I is appropriately selecting returns for audit, consistent with its mission. We also found opportunities for improvement in other areas. First, W&I has not communicated internal control responsibilities to all staff tasked with audit selection, including non-managers and classifiers who revise or apply audit selection criteria, respectively. Second, W&I does not have complete documentation its audit selection procedures; doing so would improve the assurance that W&I staff have a common understanding of how the selection process work and their role in the process. Third, while W&I’s policy is clear that internal control issues should be reported to the next level of management, the mechanism to elevate potential internal control issues to management is limited. Lastly, W&I did not provide support that changes to audit selection processes and procedures were appropriately monitored and implemented in a timely manner. Taking such actions to address these areas would help provide W&I reasonable assurance that its audit selection criteria are fair. To help ensure W&I meets its mission and selects audits fairly and with integrity, we recommend that the Commissioner of Internal Revenue take the following seven actions: Clearly define and document: (1) key terms such as “fairness”; and (2) W&I program level objectives, performance measures, and indicators for audit selection to evaluate whether the audit selection process is meeting its mission of applying the tax law with integrity and fairness to all. Clearly communicate these terms, objectives, measures, and indicators to all staff involved in the selection of returns for audit. Incorporate the new objective(s) into W&I risk assessments done for audit selection processes. Ensure that internal control responsibilities are communicated and documented for all employees, including non-managers, tasked with revising or applying W&I audit selection criteria for potential audits. Develop and implement procedures to ensure that all criteria or methods used in programs to select returns for audit are consistently documented and approved. Develop and document a clear means for IRS staff members to promptly elevate to top management possible internal control issues related to audit selection in a timely manner. Develop, document, and implement additional monitoring procedures to ensure audit selection controls and corrective actions are implemented in a timely manner. We provided a draft of this report to the Commissioner of Internal Revenue for review and comment. The Deputy Commissioner for Services and Enforcement provided written comments, including planned actions to implement each of our recommendations, dated November 23, 2015, which are summarized below and reprinted in appendix II. In an email received November 24, 2015, the Deputy Commissioner indicated through the IRS Office of Audit Coordination that IRS generally agreed with our seven recommendations. The enclosure to IRS’s letter listed specific actions planned to implement the recommendations. IRS stated in its letter that the concept of fairness has both a collective and individual component: (1) W&I pursues those individuals who fail to comply with their tax obligations to ensure fairness to those who do and to promote public confidence in the tax system; and (2) it discharges its responsibilities with a focus on taxpayer rights. IRS can build on these components to clarify how they relate to return selection, especially when the components also cover what happens after return selection, such as when pursuing noncompliance and interacting with taxpayers during the audit. Documenting these clarifications in its definition, as well as the examples of fair selections, would help staff involved in return selection to know the specific actions that they should take to produce selections that meet IRS’s definition of fairness. We highlight this clarification because the letter discusses various features of IRS’s audit program—such as existing objectives, measures, and definitions of key concepts—that IRS stated relate to fair selection. We agree that having these features is important. However, as our report discusses, these features cited in IRS’s letter do not clarify what fair selection of returns for audit entails and how IRS would know whether fair selections are occurring, unless a taxpayer or other individual raises a question about the fairness of return selection. IRS’s commitment to applying tax law with fairness and integrity is contained in its mission statement, as discussed in our report, but our recommendations focus on clearly explaining how that aspect of the mission is operationalized for audit selection. IRS identified actions that specifically reflected or were generally consistent with four of the recommendations we made. These include our recommendation on communicating the definition of terms such as fairness as well as related objectives, measures, and indicators to all staff involved in audit selection; incorporating any new selection objectives into the risk assessment process that IRS would modify in fulfilling our recommendation on defining fairness; communicating and documenting internal control responsibilities to all staff involved in audit selection; and developing a means for IRS staff to elevate internal control concerns about audit selection. For our recommendation on defining and documenting “fairness” for return selection activities, IRS’s letter listed a number of ways in which it believes the selection process is fair. For example, IRS said that its audit selections are fair because IRS policies state that audit selections should be fair and that taxpayer rights should be a prime focus. IRS’s letter also cited its reliance on rules and automation rather than human intervention and its desire to select the most noncompliant returns. While striving to be fair and respectful of taxpayer rights as well as to weed out selection bias or selections that focus on less noncompliant returns is important, IRS has not provided a formal definition of what fairness entails. As a result, individuals are left to define it for themselves. Similarly, this recommendation also focused on defining and documenting related objectives, measures, and indicators for audit selection. IRS stated that it will review these areas to further ensure that audit selection meets its mission to apply the tax law with integrity and fairness. As discussed in our report, existing IRS objectives and measures did not allow IRS to evaluate whether its selection decisions were fair. We believe IRS should develop at least one objective and measure that reflects its definition of fairness. Doing so would better enable IRS to clarify how it operationalizes fairness in the selection process and assess whether its actions are meeting that objective. In regard to our recommendation on developing and implementing procedures to ensure that all criteria or methods used in programs to select returns for audit are consistently documented and approved, IRS stated that it has procedures in place to document criteria and methods used in return selection. However, we found instances, discussed in our report, in which IRS’s documentation was not specific to return selection as well as instances in which procedures were not fully documented. Incomplete documentation makes it difficult for IRS to clearly communicate how audit selection works and defend against accusations that it is not appropriately following its processes and procedures. IRS also stated that it would review existing procedures to ensure consistent documentation and approval. Our report shows evidence of this need, such as being able to show how the selection criteria and methods were used consistently. For our recommendation on having additional procedures for monitoring audit selection controls and corrective actions, IRS stated that it will review the processes in place for documentation and timely implementation of selection controls and corrective actions to further ensure the controls and actions are implemented in a timely manner. However, our report indicated a need to do more than a review by developing additional monitoring procedures. As arranged with your office, unless you publicly announce its contents earlier, we plan no further distribution of this report until 30 days from the date of this letter. At that time, we will send copies to Secretary of the Treasury, Secretary of Labor, IRS and SEC. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-9110 or lucasjudyj@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III. This report (1) describes the Wage and Investment (W&I) process for selecting tax returns for audit; and (2) determines how well W&I’s procedures for selecting tax returns for audit support its mission and goal to apply the tax law with integrity and fairness to all. To describe the W&I process for selecting returns for review and audit, we reviewed documentation on program procedures from the Internal Revenue Manual (IRM) and Internal Revenue Service (IRS) documents describing audit procedures. We also interviewed IRS officials who oversee or who work on W&I’s audit selection process. For context, we compiled statistical information for fiscal years 2013 and 2014 about W&I audit program closures from IRS’s Compliance Data Warehouse (CDW) and Examination Operational Automation Database (EOAD). CDW provides a variety of tax return, enforcement, compliance and other data. EOAD has information on the type of issue audited. Our data reliability assessment included reviewing relevant documentation, interviewing knowledgeable IRS officials, and reviewing the data to identify obvious errors or outliers. Based on our testing of the data and review of documentation and interviews, we determined that these data were reliable for the purposes of this report. We categorized the data by project codes with input from W&I audit officials. Because of the recent realignment of audit duties among divisions, some of the project codes in our analysis—such as those associated with the Discretionary Exam Business Rules—are no longer worked by W&I. To determine how well W&I’s procedures for selecting tax returns for audit support its mission, we reviewed W&I’s audit selection procedures and related internal controls intended to help W&I achieve its stated mission of “applying the tax law with integrity and fairness to all.” We then assessed whether these relevant W&I procedures followed selected internal control standards from Standards for Internal Control in the Federal Government. We also interviewed relevant IRS officials concerning their understanding of W&I’s mission, objectives, and internal controls related to W&I’s audit selection. In addition, we reviewed the Internal Revenue Service’s Strategic Plan FY2014-2017, IRM sections related to W&I’s mission statement and program objectives, IRS’s policy statement for audits, information technology controls, W&I’s fiscal year 2014 program letter, and other IRS documentation related to W&I’s audit selection process, including internal risk assessment documents and annual meeting notes. To determine which internal control standards were most relevant for our review, we used the five internal control standards in Standards for Internal Control in the Federal Government as primary criteria and used our Internal Control Management and Evaluation Tool to identify specific factors that could be used to operationalize the internal control standards, in conjunction with observations from our preliminary audit work. We assessed whether W&I’s audit selection process addressed the selected internal control standards by reviewing documentation and interviewing IRS officials familiar with the selection process. The controls we chose applied to the processes and procedures that W&I officials described or for which they provided documentation regarding how audits were selected. While we relied on documentation demonstrating whether the standards were addressed, we did not test whether they were systemically applied. To determine IRS’s definition of fairness and integrity as it applied to W&I’s audit selection, we reviewed W&I’s mission statement and other documentation related to how W&I selects audits for examination and interviewed relevant IRS officials concerning their understanding of how integrity and fairness applies to W&I audit selection activities. We conducted this performance audit from October 2014 to December 2015 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. In addition to the contact named above, Tom Short (Assistant Director), Lisette Baylor, Sara Daleski, David Dornisch, Eric Gorman, David Hayes, Ted Hu, Melissa King, Jeffrey Knott, Sabine Paul, Susan Sato, Stewart Small, and A.J. Stephens made key contributions to this report.

Summary: Audit activities help ensure taxpayers pay the right amount of tax and help address the net $385 billion tax gap—the difference between the amount of taxes paid voluntarily and on time, and the amount owed. Audit programs in W&I mainly cover refundable credits reported on the Form 1040, Individual Income Tax Return. The hundreds of thousands of taxpayers whom W&I interacts with annually during audits make it critical to apply the tax law fairly. Unfair selection would increase burden on taxpayers and reduce public confidence in IRS. GAO was asked to review W&I's audit selection process. This report (1) describes the W&I process for selecting tax returns for audit, and (2) determines how well W&I's audit selection procedures support its mission and goal to apply the tax law with integrity and fairness to all. GAO reviewed documentation on program procedures, an audit work plan, and various Internal Revenue Manual sections; analyzed audit data from fiscal years 2013 and 2014; and interviewed relevant IRS officials. Three offices in the Internal Revenue Service's (IRS) Wage and Investment division (W&I) are responsible for selecting returns for audit. Most returns are selected via computer systems that automatically send notices to taxpayers based on certain criteria, such as the validity of dependents. W&I program officials annually review the criteria and apply updates to the following filing season's returns. In 2014, about 59 percent of all W&I audits—more than 516,000—were selected with a specialized computer tool called the Dependent Database, while the remainder was selected through a combination of referrals and manual selection methods. W&I generally has established a positive environment for internal controls but could improve several areas in its audit selection procedures to support its mission. GAO found several procedures that establish a positive environment for promoting internal controls, such as ethics training. In addition, IRS has guidance to help ensure that decisions about updates to audit selection criteria are correctly implemented in its automated systems. However, W&I does not have established objectives for its audit selection process, and existing performance measures focus on audit results rather than audit selection. In addition, W&I has not defined key terms such as “fairness and integrity,” as required by internal control standards. Documented objectives and key terms would help W&I hone the measures it uses to assess its audit selection efforts and bring a consistent understanding of “fairness and integrity” to audit selection staff. GAO also found that not all elements of the selection process were appropriately documented. For example, W&I does not have clear documentation about how the three offices that select the majority of returns W&I audits interact with one another. Additionally, one guidance document notes that returns with the highest audit potential should be marked, but it does not describe how audit potential is determined or any related internal controls. Further, W&I also did not provide support showing that changes to automated audit selection processes and procedures were appropriately implemented in a timely manner. Moreover, the documentation indicates that W&I conducts an annual—rather than continuous—review of its audit selections and results as part of an annual 3-day working session. Strengthening controls in these areas would help provide greater assurance that W&I is fulfilling its mission to select tax returns with fairness and integrity. Additionally, the absence of a fully documented selection process may make it difficult for W&I to defend against accusations that it is not appropriately following its processes and procedures. GAO recommends, among other things, that IRS establish program objectives and definitions of key terms such as “fairness” that apply to audit selection and use those definitions in assessing its selection performance; document selection processes more thoroughly; and document that changes to procedures are done in a timely manner. IRS generally agreed with all seven recommendations and provided additional comments reprinted in appendix II.