The mission of IRS, a bureau within the Department of the Treasury, is to (1) provide America’s taxpayers top quality service by helping them understand and meet their tax responsibilities and (2) enforce the law with integrity and fairness to all. In carrying out its mission, IRS annually collects over $3 trillion in taxes from millions of taxpayers, and manages the distribution of over $400 billion in refunds. To guide its future direction, the agency has two strategic goals: (1) deliver high quality and timely service to reduce taxpayer burden and encourage voluntary compliance; and (2) effectively enforce the law to ensure compliance with tax responsibilities and combat fraud. Effective management of IT is critical for agencies to achieve successful outcomes. This is particularly true for IRS, given the role of IT in enabling the agency to carry out its mission and responsibilities. For example, IRS relies on information systems to process tax returns; account for tax revenues collected; send bills for taxes owed; issue refunds; assist in the selection of tax returns for audit; and provide telecommunications services for all business activities, including the public’s toll-free access to tax information. For fiscal year 2016, IRS was pursuing 23 major and 114 non-major IT investments to carry out its mission. According to the agency, it expended approximately $2.7 billion on these investments during fiscal year 2016, including $1.9 billion, or 70 percent, for operations and maintenance activities, and approximately $800 million, or 30 percent, for development, modernization, and enhancement. We have previously reported on a number of the agency’s major investments, to include the following investments in development, modernization, and enhancement: The Affordable Care Act investment encompasses the planning, development, and implementation of IT systems needed to support tax administration responsibilities associated with key provisions of the Patient Protection and Affordable Care Act. IRS expended $253 million on this investment in fiscal year 2016. Customer Account Data Engine 2 is being developed to replace the Individual Master File investment, IRS’s authoritative data source for individual tax account data. A major component of the program is a modernized database for all individual taxpayers that is intended to provide the foundation for more efficient and effective tax administration and help address financial material weaknesses for individual taxpayer accounts. Customer Account Data Engine 2 data is also expected to be made available for access by downstream systems, such as the Integrated Data Retrieval System for online transaction processing by IRS customer service representatives. IRS expended $182.6 million on this investment in fiscal year 2016. The Return Review Program is IRS’s system of record for fraud detection. As such, it is intended to enhance the agency’s capabilities to detect, resolve, and prevent criminal and civil tax noncompliance. In addition, it is intended to allow analysis and support of complex case processing requirements for compliance and criminal investigation programs during prosecution, revenue protection, accounts management, and taxpayer communications processes. According to IRS, as of May 2017, the system has helped protect over $4.5 billion in revenue. IRS expended $100.2 million on this investment in fiscal year 2016. We have also reported on the following investments in operations and maintenance: Mainframes and Servers Services and Support provides for the design, development, and deployment of server; middleware; and large systems and enterprise storage infrastructures, including supporting systems software products, databases, and operating systems. This investment has been operational since 1970. IRS expended $499.4 million on this investment in fiscal year 2016. Telecommunications Systems and Support provides for IRS’s network infrastructure services such as network equipment, video conference service, enterprise fax service, and voice service for over 85,000 employees at about 1,000 locations. According to IRS, the investment supports the delivery of services and products to employees, which translates into service to taxpayers. IRS expended $336.4 million on this investment in fiscal year 2016. Individual Master File is the authoritative data source for individual taxpayer accounts. Using this system, accounts are updated, taxes are assessed, and refunds are generated as required during each tax filing period. Virtually all IRS information system applications and processes depend on output, directly or indirectly, from this data source. IRS expended $14.3 million on this investment in fiscal year 2016. In fiscal year 2017, the federal government planned to spend more than $89 billion for IT that is critical to the health, economy, and security of the nation. However, we have reported that prior IT expenditures have often resulted in significant cost overruns, schedule delays, and questionable mission-related achievements. In light of these ongoing challenges, in February 2015, we added improving the management of IT acquisitions and operations to our list of high-risk areas for the federal government. This area highlights several critical IT initiatives in need of additional congressional oversight, including (1) reviews of troubled projects; (2) efforts to increase the use of incremental development; (3) efforts to provide transparency relative to the cost, schedule, and risk levels for major IT investments; (4) reviews of agencies’ operational investments; (5) data center consolidation; and (6) efforts to streamline agencies’ portfolios of IT investments. We noted that implementation of these initiatives has been inconsistent and more work remains to demonstrate progress in achieving acquisitions and operations outcomes. Between fiscal years 2010 and 2015, we made about 800 recommendations related to this high-risk area to the Office of Management and Budget and agencies. As of September, 2017, about 54 percent of these recommendations had been implemented. The Federal Information Technology Acquisition Reform provisions (commonly referred to as FITARA), enacted as a part of the Carl Levin and Howard P. ‘Buck’ McKeon National Defense Authorization Act for Fiscal Year 2015, aimed to improve federal IT acquisitions and operations and recognized the importance of the initiatives mentioned above by incorporating certain requirements into the law. For example, among other things, the act requires the Office of Management and Budget to publicly display investment performance information and review federal agencies’ IT investment portfolios. The current administration has also initiated additional efforts aimed at improving federal IT. Specifically, in March 2017, the administration established the Office of American Innovation, which has a mission to, among other things, make recommendations to the President on policies and plans aimed at improving federal government operations and services and modernizing federal IT. Further, in May 2017, the administration established the American Technology Council, which has a goal of helping to transform and modernize federal agency IT and how the federal government uses and delivers digital services. Recently this council worked with several agencies to develop a draft report on modernizing IT in the federal government. The council released the draft report for public comment in August 2017. In reviews that we have undertaken over the past several years, we have identified various opportunities for the IRS to improve the management of its IT investments. These reviews have identified a number of weaknesses with the agency’s reporting on the performance of its modernization investments to Congress and other stakeholders. In this regard, we have pointed out that information on investments’ performance in meeting cost, schedule, and scope goals is critical to determining the agency’s progress in completing key IT investments. We have also stressed the importance of the agency addressing weaknesses in its process for prioritizing modernization activities. Accordingly, we have made a number of related recommendations, which IRS is in various stages of implementing. In our June 2012 report on IRS’s performance in meeting cost, schedule, and scope goals for selected investments, we noted that, while IRS reported on the cost and schedule of its major IT investments, the agency did not have a quantitative measure of scope—a measure that shows whether these investments delivered planned functionality. We stressed that having such a measure is a good practice as it provides information about whether an investment has delivered the functionality that was paid for. Accordingly, we recommended that the agency develop a quantitative measure of scope for its major IT investments, to have more complete information on the performance of these investments. In response, IRS started developing a quantitative measure of scope for selected investments in December 2015 and has been working to gradually expand the measure to other investments. In April 2013, based on another review of IRS’s performance in meeting cost, schedule, and scope goals, we reported that there were weaknesses, to varying degrees, in the reliability of IRS’s investment performance information. Specifically, we found that IRS had not updated investment cost and schedule variance information with actual amounts on a timely basis (i.e., within the 60-day time frame required by the Department of Treasury) in about 25 percent of the activities associated with the investments selected in our review. In addition, the agency had not specified how project managers should estimate the cost and schedule performance of ongoing projects. As a result of these findings, we recommended that IRS ensure that its projects consistently follow guidance for updating performance information 60 days after completion of an activity and develop and implement guidance that specifies best practices to consider when estimating ongoing projects’ progress in meeting cost and schedule goals. IRS agreed with, and subsequently addressed, the recommendation related to updating performance information on a timely basis. However, the agency partially disagreed with the recommendation to develop guidance on estimating progress in meeting cost and schedule goals for ongoing projects. In this regard, we had suggested the use of earned value management data as a best practice to determine projected cost and schedule amounts. IRS did not agree with the use of the technique, stating that it was not part of the agency’s current program management processes and that the cost and burden to use earned value management would outweigh the value added. We disagreed with the agency’s view of earned value management because best practices have found that its value generally outweighs the cost and burden of its implementation (although we suggested it as one of several examples of practices that could be used to determine projected amounts). We also stressed that implementing our recommendation would help improve the reliability of reported cost and schedule variance information, and that IRS had flexibility in determining which best practices to use to calculate projected amounts. For those reasons, we maintained that our recommendation was warranted. However, IRS has yet to address the recommendation. We reported in April 2014, that the cost and schedule performance information that IRS reported for its major investments was for the fiscal year only. We noted that this reporting would be more meaningful if supplemented with cumulative cost and schedule performance information in order to better indicate progress toward meeting goals. In addition, we noted that the reported variances for selected investments were not always reliable because the estimated and actual cost and schedule amounts on which they depended had not been consistently updated in accordance with Department of Treasury reporting requirements as we had previously recommended. We recommended that IRS report more comprehensive and reliable cost and schedule information for its major investments. The agency agreed with our recommendation and said it believed it had addressed the recommendation in its quarterly reports to Congress. We disagreed with IRS’s assertion, however, noting that, while the report includes cumulative costs, they are cumulative for the fiscal year, not for the investment or investment segment as we recommended and they therefore do not account for cost variances from prior fiscal years. We therefore maintained our recommendation. In February 2015, after assessing the status and plans of the Return Review Program and Customer Account Data Engine 2, we reported that these investments had experienced significant variances from initial cost, schedule, and scope plans; yet, IRS did not include these variances in its reports to Congress because the agency had not addressed our prior recommendations. Specifically, IRS had not addressed our recommendation to report on how delivered scope compared to what was planned, and it also did not address guidance for determining projected cost and schedule amounts, or the reporting of cumulative cost and schedule performance information. We stressed that implementing these recommendations would improve the transparency of congressional reporting so that Congress has the appropriate information needed to make informed decisions. We made additional recommendations for the agency to improve the reliability and reporting of investment performance information and management of selected major investments. IRS agreed with the recommendations and has since addressed them. In our most recent report in June 2016, we assessed IRS’s process for determining its funding priorities for both modernization and operations. We found that the agency had developed a structured process for allocating funding to its operations activities consistent with best practices, which specify that an organization should document policies and procedures for selecting new and reselecting ongoing IT investments, and include criteria for making selection and prioritization decisions. However, IRS did not have a similarly structured process for prioritizing its modernization activities, to which the agency allocated hundreds of millions of dollars for fiscal year 2016. Agency officials stated that discussions were held to determine the modernization efforts that were of highest priority to meet IRS’s future state vision and technology roadmap. The officials reported that staffing resources and lifecycle stage were considered, but there were no formal criteria for making final determinations. Senior IRS officials said they did not have a structured process for the selection and prioritization of business systems modernization activities because the projects were established; and there were fewer competing activities than for operations support. Nevertheless, we stressed that, while there may have been fewer competing activities, a structured, albeit simpler, process that is documented and consistent with best practices would provide transparency into the agency’s needs and priorities for appropriated funds. We concluded that such a process would better assist Congress and other decision makers in carrying out their oversight responsibilities. Accordingly, we recommended that IRS develop and document its processes for prioritizing IT funding. The agency agreed with the recommendations and has taken steps to address them. Further, we found that IRS had reported complete performance information for two of the six selected investments in our review, to include a measure of progress in delivering scope, which we have been recommending since 2012. However, the agency did not always use best practices for determining the amount of work completed by its own staff, resulting in inaccurate reports of work performed. Consequently, we recommended that IRS modify its processes for determining the work performed by its staff. The agency disagreed with the recommendation, stating that the costs involved would outweigh the value provided. Specifically, IRS stated that modifying the use of the level of effort measure would equate to a certified earned value management system, which would add immense burden on IRS’s programs on various fronts and would outweigh the value it provides. However, we did not specify the use of an earned value management system in our report and believe other methods could be used to more reliably measure work performed.. In addition, we believed that it is a reasonable expectation for IRS to reliably determine the actual work completed, as opposed to assuming that work is always completed as planned since, as noted in our report, 22 to 100 percent of the work for selected projects was performed by IRS staff. Accordingly, we maintained that the recommendation was still warranted. Our work has also emphasized the importance of IRS more effectively managing its aging legacy systems. For example, in November 2013, we reported on the extent to which 10 of the agency’s large investments had undergone operational analyses—a key performance evaluation and oversight mechanism required by the Office of Management and Budget to ensure investments in operations and maintenance continue to meet agency needs. We noted that IRS’s Mainframe and Servers Services and Support had not had an operational analysis for fiscal year 2012. As a result, we recommended that the Secretary of Treasury direct appropriate officials to perform an operational analysis for the investment, including ensuring that the analysis addressed the 17 key factors identified in the Office of Management and Budget’s guidance for performing operational analyses. The department did not comment on our recommendation but subsequently implemented it. In addition, we previously reported on legacy IT systems across the federal government, noting that these systems were becoming increasingly obsolete and that many of them used outdated software languages and hardware parts that were unsupported. As part of that work, we noted that the Department of the Treasury used assembly language code—a computer language initially used in the 1950s and typically tied to the hardware for which it was developed—and Common Business Oriented Language (COBOL)—a programming language developed in the late 1950s and early 1960s—to program its legacy systems. It is widely known that agencies need to move to more modern, maintainable languages, as appropriate and feasible. For example, the Gartner Group, a leading IT research and advisory company, has reported that organizations using COBOL should consider replacing the language and, in 2010, noted that there should be a shift in focus to using more modern languages for new products. The use of COBOL presents challenges for agencies such as IRS given that procurement and operating costs associated with this language will steadily rise, and because fewer people with the proper skill sets are available to support the language. Further, we reported that IRS’s Individual Master File was over 50 years old and, although IRS was working to modernize it, the agency did not have a time frame for completing the modernization or replacement. Thus, we recommended that the Secretary of the Treasury direct the Chief Information Officer to identify and plan to modernize and replace legacy systems, as needed, and consistent with the Office of Management and Budget’s draft guidance on IT modernization, including time frames, activities to be performed, and functions to be replaced or enhanced. The department had no comments on our recommendation. We will continue to follow-up with the agency to determine the extent to which this recommendation has been addressed. In addition, we have ongoing work identifying risks associated with IRS’s legacy IT systems, and the agency’s management of these risks. In summary, IRS faces longstanding challenges in managing its IT systems. While effective IT management has been a prevalent issue throughout the federal government, it is especially concerning at IRS given the agency’s extensive reliance on IT to carry out its mission of providing service to America’s taxpayers in meeting their tax obligations. Thus, it is important that the agency establish, document, and implement policies and procedures for prioritizing its modernization efforts, as we have recently recommended, and provide Congress with accurate information on progress in delivering such modernization efforts. In addition, we have emphasized the need for IRS to address the inherent challenges associated with aging legacy systems so that it does not continue to maintain investments that have outlived their effectiveness and are consuming resources that outweigh their benefits. Continued attention to implementing our recommendations will be vital to helping IRS ensure the effective management of its efforts to modernize its aging IT systems and ensure its multibillion dollar investment in IT is meeting the needs of the agency. Chairman Buchanan, Ranking Member Lewis, and Members of the Subcommittee, this completes my prepared statement. I would be pleased to respond to any questions that you may have at this time. If you or your staffs have any questions about this testimony, please contact me at (202) 512-9286 or at pownerd@gao.gov. Individuals who made key contributions to this testimony are Sabine Paul (Assistant Director), Rebecca Eyler, and Bradley Roach (Analyst in Charge). IRS 2013 Budget: Continuing to Improve Information on Program Costs and Results Could Aid in Resource Decision Making, GAO-12-603 (Washington, D.C.: June 8, 2012) Information Technology: Consistently Applying Best Practices Could Help IRS Improve the Reliability of Reported Cost and Schedule Information, GAO-13-401 (Washington, D.C.: April 17, 2013) Information Technology: Agencies Need to Strengthen Oversight of Multibillion Dollar Investments in Operations and Maintenance, GAO-14-66 (Washington, D.C.: Nov. 6, 2013) Information Technology: IRS Needs to Improve the Reliability and Transparency of Reported Investment Information, GAO-14-298 (Washington, D.C.: April 2, 2014) Information Technology: Management Needs to Address Reporting of IRS Investments’ Cost, Schedule, and Scope Information, GAO-15-297 (Washington, D.C.: February 25, 2015) Information Technology: Federal Agencies Need to Address Aging Legacy Systems, GAO-16-468 (Washington, D.C.: May 25, 2016) This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: The IRS, a bureau of the Department of the Treasury, relies extensively on IT to annually collect more than $3 trillion in taxes, distribute more than $400 billion in refunds, and carry out its mission of providing service to America's taxpayers in meeting their tax obligations. For fiscal year 2016, IRS expended approximately $2.7 billion for IT investments, 70 percent of which was allocated for operational systems. GAO has long reported that the effective and efficient management of IT acquisitions and operational investments has been a challenge in the federal government. Accordingly, in February 2015, GAO introduced a new government-wide high-risk area, Improving the Management of IT Acquisitions and Operations. GAO has also reported on challenges IRS has faced in managing its IT acquisitions and operations, and identified opportunities for IRS to improve the management of these investments. In light of these challenges, GAO was asked to testify about IT management at IRS. To do so, GAO summarized its prior work regarding IRS's IT management, including the agency's management of operational, or legacy, IT systems. GAO has issued a series of reports in recent years which have identified numerous opportunities for the Internal Revenue Service (IRS) to improve the management of its major acquisitions and operational, or legacy, information technology (IT) investments. For example, In June 2016, GAO reported that IRS had developed a structured process for allocating funding to its operations activities, consistent with best practices; however, GAO found that IRS did not have a similarly structured process for prioritizing modernization activities to which the agency allocated hundreds of millions of dollars for fiscal year 2016. Instead, IRS officials stated that they held discussions to determine the modernization efforts that were of highest priority to meet IRS's future state vision and technology roadmap, and considered staffing resources and lifecycle stage. However, they did not use formal criteria for making final determinations. GAO concluded that establishing a structured process for prioritizing modernization activities would better assist Congress and other decision makers in ensuring that the right priorities are funded. Accordingly, GAO recommended that IRS establish, document, and implement policies and procedures for prioritizing modernization activities. IRS agreed with the recommendation and has efforts underway to address it. In the same report, GAO noted that IRS could improve the accuracy of reported performance information for key development investments to provide Congress and other external parties with pertinent information about the delivery of these investments. This included investments such as Customer Account Data Engine 2, which IRS is developing to replace its 50-year old repository of individual tax account data, and the Return Review Program, IRS's system of record for fraud detection. GAO recommended that IRS take steps to improve reported investment performance information. IRS agreed with the recommendation, and has efforts underway to address it. In a May 2016 report on legacy IT systems across the federal government, GAO noted that IRS used assembly language code to program key legacy systems. Assembly language code is a computer language initially used in the 1950s that is typically tied to the hardware for which it was developed; it has become difficult to code and maintain. One investment that used this language is IRS's Individual Master File which serves as the authoritative data source for individual taxpayer accounts. GAO noted that, although IRS has been working to replace the Individual Master File, the bureau did not have time frames for its modernization or replacement. Therefore, GAO recommended that the Department of Treasury identify and plan to modernize and replace this legacy system, consistent with applicable guidance from the Office of Management and Budget. The department had no comments on the recommendation. GAO has made a number of recommendations to IRS to improve its management of IT acquisitions and operations. IRS has generally agreed with the recommendations and is in various stages of implementing them.