IRS’s process for collecting unpaid tax debts includes: Notice Phase: IRS sends the taxpayer an automatically-generated series of letters about unpaid debts or delinquent returns to prompt payment or response if the taxpayer disagrees with the balance due or is unable to pay the amount owed. Automated Collection System: IRS attempts to have telephone contact with the taxpayer to discuss the debt and prompt full payment or set up a payment installment agreement. According to IRS officials, telephone contact generally happens when taxpayers call IRS in response to IRS enforcement notices or actions, such as filing a lien against the taxpayer’s property or levying financial assets. Field Collection: IRS revenue officers attempt in-person contact with taxpayers to prompt a payment or take enforcement action such as those described above with the Automated Collection System. According to IRS, its collection efforts focus on the potentially collectible inventory. IRS attempts to prioritize the debts it believes it will most likely be able to collect, based on an analysis of factors such as the debt amount and the taxpayer’s ability to pay it. In 1995, Congress authorized IRS to contract with private debt collectors to collect unpaid tax debts. In 1997 we reported IRS data showing that the program cost about $21.1 million and collected about $3.1 million. The program was canceled, in part, because of the net loss. In October 2004, Congress granted discretionary authority to IRS for creating a PDC program to collect some portion of unpaid taxes. The program enabled IRS to contract with private collection agencies to collect tax debts and pay them from a revolving fund of the revenue collected. IRS said it would study the comparative performance of private collection agencies versus the agency in collecting unpaid taxes because of concerns that the program might cost more than using IRS resources to collect the debts. IRS began assigning cases to private collection agencies in September 2006. It began the study at that time too. In March 2009, IRS released its study, which concluded that IRS was more cost effective than collection agencies in collecting tax debts when working similar cases. As a result, IRS announced that it would not renew expiring contracts with the private collection agencies. The Fixing America’s Surface Transportation (FAST) Act in 2015 mandated that IRS assign inactive tax debt cases to private collection agencies. Inactive cases are those that IRS includes in its potentially collectible inventory but is not actively pursuing. Congress defined three types of inactive tax debt cases that must be assigned to the collection agencies, which are those: removed from active inventory due to a lack of IRS resources or inability to contact a taxpayer; not assigned for collection to an IRS employee and more than one- third of the period of applicable statute of limitation has lapsed; and assigned for collection and more than 365 days have passed without any interaction with the taxpayer or a third party for purposes of furthering collection. The act also excluded certain taxpayer accounts from being assigned to a collection agency. Specifically, accounts are to be excluded if the taxpayer is deceased; under the age of 18; in designated combat zones; a victim of tax-related identity theft; under examination, litigation, criminal investigation or levy; subject to pending or active offers in compromise, an installment agreement, or a right of appeal; or involved in an innocent spouse case. The American Jobs Creation Act and the FAST Act together created two funds which allow IRS to retain up to 50 percent of the amounts collected by private collection agencies. Specifically, IRS can retain up to 25 percent of the amounts that collection agencies collect in each of these funds: Cost of Services fund to pay collection agencies’ commissions. Special Compliance Personnel Program fund to pay costs of administering the collection agency contracts and costs of adding collection staff. According to IRS officials, IRS’s approach for implementing the PDC program is to roll out cases over time in three major phases, moving from simpler to more complex cases. The first phase (April 2017) included the simplest types of cases in which individual taxpayers had agreed to the debt owed. The second phase (March 2018) added individual tax debts from IRS compliance activities—such as auditing the accuracy of filed tax returns—where taxpayers have not agreed with the debt owed and unfiled tax returns (i.e., from individuals who did not file tax returns as required). The third phase (planned for March 2019) is to add business tax debt cases and unfiled business tax returns. As shown in figure 1, since first assigning cases to collection agencies in April 2017, IRS has increased the number and types of tax debt cases. By the end of fiscal year 2019, IRS plans to have assigned about 2.4 million cases that it expects to be eligible for the PDC program. IRS has not clearly defined program objectives, measures, and targets for the PDC program. According to federal internal control standards, management should define objectives clearly to enable the identification of risks and define risk tolerances. Objectives should be defined in specific and measurable terms to enable design of internal control for related risks. Establishing measures and related targets also allows assessment of program performance and helps ensure that objectives are achieved. Although IRS started sending cases to collection agencies under the PDC program in April 2017, IRS did not document the program’s objectives and their links to related proposed measures until October 2018. IRS officials explained that they wanted to get some experience with the program before establishing its objectives and measures, so in June 2018 and August 2018, officials held working sessions to draft the program’s mission, vision, and values statements, and link performance metrics to them. The resulting proposed mission statement was to “provide taxpayers an opportunity to understand and resolve their tax obligations and apply tax laws in a manner that is consistent with IRS collection practices.” The sessions also yielded the following statements under related categories that according to IRS officials are the PDC program’s three program objectives. Taxpayer Protection—Apply tax laws in a manner that is consistent Taxpayer Experience/Satisfaction—Provide taxpayers an opportunity to understand and resolve their tax obligations Private Collection Agency Operational Success—Resolve tax obligations by utilizing private collection agencies According to the working sessions’ documents, officials also proposed PDC measures. However, our review found that these measures did not clearly link to two of the three PDC objectives—applying tax laws consistently with IRS collection practices and providing taxpayers an opportunity to understand and resolve their tax obligations. Table 1 shows our analysis of the clarity of the links between the objectives and proposed measures, and the lack of targets for each of the objectives and measures. In addition, based on our discussions with IRS officials and review of PDC program documents, IRS’s three program objectives do not acknowledge all key program-related risks. For example, because high costs put previous PDC programs at risk, IRS officials said they designed program procedures to control costs and compare these costs to revenue collections. However, none of the objectives or measures addresses costs compared to revenue collections. Similarly, IRS has acknowledged the risks of scams and created risk responses but none of the three objectives focuses on protecting taxpayers from the risks of scams. Our review of IRS documentation also shows that IRS has used inconsistent terms to communicate the program’s objectives. Specifically, IRS’s fiscal year 2019 communication plan for the PDC program states different program objectives than those in the working session documents. This document states the program’s objectives as: help America’s taxpayers settle their debt and come into compliance; ensure the safety and security of taxpayers and their data; and ensure that all taxpayers contacted by private collectors are treated with fairness and respect by monitoring the program. These objectives do not include terms used in the objectives stated in table 1, such as applying tax laws consistently with collection practices while they introduce new terms such as compliance, safety and security, and fairness and respect. Although the two sets of objectives do not necessarily conflict, their differing, inconsistent terms contribute to the stated program objectives being unclear. According to IRS officials, the objectives defined by the working sessions are the objectives for the PDC program. They said that IRS needs more time to finalize the program objectives and measures and develop related targets. The officials said their efforts and resources until recently had been directed toward implementing the PDC program. However, they do not expect to finish refining the objectives, measures, and targets until fiscal year 2020 or later, when they will use program data that may be available then. Until program objectives are clearly defined and consistently stated, IRS cannot ensure that appropriate controls will be in place to address risks and achieve the desired results of the PDC program. Also, without measures and targets that are clearly linked to the objectives, IRS will be limited in its ability to assess and assure that the program is making progress in achieving its objectives. According to federal internal control standards, management should externally communicate complete, quality information necessary to achieve objectives. Ways to carry this out include using and reporting complete financial information. However, we found that IRS’s reporting on the PDC program to Congress did not provide complete, quality financial information on some of the program’s results for revenue collected and costs. Specifically, IRS’s reporting did not clarify how much of the collected revenue went to the general fund of the Treasury (the Treasury) rather than to IRS for two special funds. For example, from fiscal year 2016 when IRS started to develop the program through September 2018, IRS’s report to Congress in October 2018 showed program revenue collections of $88.8 million and costs of $66.5 million—a program balance of $22.3 million. While suggesting this positive program balance to the Treasury, the report did not clarify that about $50.9 million of the $88.8 million went to the Treasury and about $37.8 million went to the two IRS special funds—about $18.9 million for each—to pay current and future related IRS costs (see table 2 in appendix II). The report included the required information on the collected revenue retained in the two special funds. We analyzed the status of the two funds as of September 2018 (see table 3 in appendix II). The $18.9 million that IRS retained to pay the costs for commissions to the contracted collection agencies had a balance of $2.9 million; the $18.9 million that IRS retained to pay costs to administer the PDC contracts and hire and train additional staff for IRS collection activities had a balance of $14.6 million. IRS officials said IRS used this fund to hire 100 additional collection staff in October 2018. The officials said that information system improvements will allow IRS to track the revenue collections and costs related to those additional staff pursuing tax debts. IRS officials said in September 2018 that they plan for future reports to include a program balance table and retained fund balance tables. However, they said IRS does not plan to include a table on the amount of collected revenue that went to the Treasury because IRS is not required to include this in the report. Full reporting of revenue and costs can help stakeholders better understand and assess program results. Without clearly reported data, stakeholders are challenged to know how much of the collected revenue went to the Treasury rather than to IRS’s two funds. Nor did IRS’s reporting to Congress include all PDC program costs. As discussed above, ways for management to meet internal control standards include using and communicating quality information on achieving program objectives. IRS has not included the costs incurred by the Treasury Inspector General for Tax Administration’s (TIGTA) Office of Investigation to operate the system for taxpayer complaints about collection agencies, which is part of the PDC program (see table 4 in appendix II for IRS’s reported costs). IRS officials said that IRS did not include TIGTA’s program costs because IRS does not typically include costs incurred by TIGTA or other agencies in its program costs. However, by not including TIGTA’s operational costs, as opposed to its audit costs, Congress is not informed of full PDC program costs. Our work has shown that using performance data helps agencies achieve better results. Federal internal control standards also require that management use quality information to achieve objectives. The standards also point out that management is responsible for an effective internal control system that minimizes the waste of resources. In addition, an IRS strategic goal includes analyzing data to improve decision-making and program results. However, IRS does not have plans to analyze data to identify ways to improve the results of the PDC program by using this information to guide the types of cases sent to collection agencies. We found that IRS has not conducted any analysis of PDC results to determine which types of cases are not potentially collectible and should not be assigned to collection agencies because they result in little or no collected revenue. Our analysis of IRS data showed that certain cases assigned to collection agencies generally have had limited results. Specifically, from April 2017 to September 2018, collection agencies had only collected $88.8 million of the $5.7 billion assigned—1.6 percent—in about 730,000 cases. closed about 111,000 cases, of which about 38,000 were closed as either fully paid or with an installment agreement, while about 56,000 were recalled by IRS and 17,000 were returned by collection agencies with little or no revenue collected. IRS officials said that these recalled and returned cases may have generated some revenue but did not know how much. Although revenue amounts were not known, IRS fiscal year 2018 data showed that collection agencies returned 288 cases (1.7 percent of about 17,000 cases returned in 2018) with a partial debt payment. In addition, our review of IRS’s data indicated that most returned cases would not have had collected revenue. According to these fiscal year 2018 data, more than 95 percent of the 17,000 cases—involving $183 million in tax debt— were returned because the collection agencies indicated that: they were unable to collect on the debt or contact the taxpayer, or the taxpayer received Social Security supplemental or disability income payments (which are to be returned because these taxpayers have limited resources or ability to pay, according to IRS officials), asked the collection agency to cease contact, or had died. When we shared our analysis with IRS officials, they said they were not surprised by these limited PDC collection results because IRS considers them to have low collection potential. Furthermore, many taxpayers may not be able to pay because they have low income. In September 2018, TIGTA reported that 54 percent of taxpayer accounts assigned to collection agencies had a low income indicator. By pursuing such cases that produce little or no revenue, IRS increases PDC program costs to manage the cases being sent and returned as well as the burdens for taxpayers who have to respond to collection agencies’ contacts. However, IRS officials said that they have not analyzed these results and do not have data on either the costs or the burdens associated with these cases. We also found that IRS does not have plans to analyze PDC program results and inactive debt cases to identify cases that IRS will not pursue that could be added to the PDC inventory. These cases could have higher collection potential than many of the current PDC cases that are collecting little or no revenue even though this potential has not been high enough to be actively pursued by IRS. For example, IRS could use its discretion to assign cases before they meet the FAST Act’s case age requirements criteria for collection agency assignment. Assigning such cases earlier could improve PDC program results because of the debt collection principle that collection success generally worsens as cases age. Similarly, IRS does not have plans to analyze PDC results to identify characteristics of cases with the highest collection results and use that analysis to find other types of inactive cases with similar characteristics that could be included in the PDC inventory. IRS officials said they are not conducting or planning such analyses because their priority is to fully implement the program and assign the types of cases to collection agencies that the FAST Act mandates. They said that they may consider expanding the types of cases sent to collection agencies after March 2019 and that they do not know whether they will do related analyses or when any decision will occur. However, for both the debt cases that could be excluded or added, IRS has existing discretionary authority to revise the PDC inventory. For example, IRS has authority to exclude cases from the PDC program if IRS determines they are not potentially collectible. Furthermore, prior law grants IRS the discretion to assign collection agencies cases beyond the three types of cases specified by the FAST Act. Even so, IRS officials said that they have no plans to analyze data on whether to revise the PDC inventory to reduce costs or maximize revenue collection. By not analyzing the results of the PDC cases, IRS risks continuing to send cases to collection agencies that collect little or no revenue and incur costs that waste federal resources as well as burden taxpayers. If most of the more than 2 million cases slated for collection agency assignment into 2019 collect little or no revenue, the accumulated IRS costs as well as burdens imposed on taxpayers could be significant. Similarly, by not analyzing new types of cases that could be assigned to private collection agencies, IRS could miss opportunities to assign cases that collect more revenue than cases that these agencies currently return with little or no revenue. As shown in figure 2 and as described in greater detail below, IRS has made progress in implementing elements of a risk management process for its PDC program but has not completed full implementation of the process. IRS has involved leadership in supporting the risk management process but has not aligned the process with objectives for protecting taxpayers in the PDC program. We previously reported that agency officials should engage leadership and regularly consider risks and how they could affect achievement of objectives. IRS’s initial discussions of risk—including taxpayer risks—involved PDC leadership and internal stakeholders, and followed guidance from the Office of Chief Risk Officer, according to IRS officials. IRS created a risk register to track the status of PDC risks. PDC leadership and IRS stakeholders continue to update these risks biweekly, according to IRS officials. In addition, IRS has developed a program mission statement and draft objectives. However, IRS has not aligned its risk management process for the PDC program with an objective for protecting taxpayers because, as discussed earlier in this report, IRS has not yet finalized its objectives for the PDC program. IRS has taken some steps to identify risks; however, we found various weaknesses in its implementation of this risk management element. According to our 2016 report on risk management, agencies should assemble a comprehensive list of risks that could affect achievement of goals and objectives. IRS’s risk register includes taxpayer risks that IRS internal stakeholders initially identified and continue to update biweekly, according to IRS officials. IRS assigned each of these a risk category— such as taxpayer rights and protection—and most risks have an IRS official assigned to manage them. Our prior work found that clearly documenting actions taken in a risk management process—such as in a risk register—facilitates systematic risk review to help accomplish an agency’s mission. However, we found that IRS has not documented a comprehensive list of specific risks to taxpayers in the risk register. IRS’s risk register identified 6 taxpayer risks but we identified another 10 risks by reviewing other PDC documentation, such as the Policy and Procedures Guide, and by interviewing external stakeholders, as shown in figure 3. For example, IRS did not identify in the risk register the risk that taxpayers may agree to debt payments they cannot afford. Also, IRS has not aligned the taxpayer risks with one or more PDC objectives because IRS has not yet finalized the objectives, as previously discussed. IRS officials said they did not list all taxpayer risks in the risk register because they covered many of these risks in other PDC program documents. Even so, not documenting risks and aligning them with the objectives in the risk register will make it more difficult to properly manage all taxpayer risks. Furthermore, based on our review, the register identified many risks that are broad and unclear. For example, IRS’s description of a taxpayer rights risk is broad and unclear on which rights are at risk given the 10 taxpayer rights in the Taxpayer Bill of Rights. For other risks, we found that IRS did not clearly state the risk to taxpayers. For example, IRS identified certain taxpayer risks with a focus on: giving taxpayers an opportunity to agree to pay their tax debts through a series of payments rather than the effects on taxpayers if they are unable to make all payments; and harming IRS’s reputation if collection agencies do not follow IRS standards rather than clarifying any specific risks to taxpayer rights. While IRS identified some taxpayer risks, the lack of completeness and clarity in IRS’s risk register limits its effectiveness as a tool for tracking taxpayer risks. As a result, IRS does not have reasonable assurance that it has fully identified and addressed all taxpayer risks from the PDC program. IRS has not consistently documented its assessment of taxpayer risks from the PDC program, making it unclear how risks will be prioritized. Our 2016 report on risk management describes the importance of assessing the impact and likelihood of risks so risks can be prioritized. This step is necessary to guide decisions on how to respond to risks. Before implementing the PDC program in April 2017, IRS assessed potential risks and developed sections in the risk register on risk impacts, likelihood, and responses that IRS would use to address each risk. However, IRS has not clearly documented the impacts for each risk in the risk register. We found that the column in the risk register designated for capturing risk impact was generally blank or contained just a date. We also found that IRS did not fully capture information on the severity of a risk’s impact. For example, in a column for recording severity in the risk register, we found information on the implementation status of a risk response instead. Further, although IRS officials said they continue to monitor “closed” risks, we found that the register recorded no information about the severity of the risk impact after IRS implemented a response. Instead, the register recorded the risk as “closed.” We also found that IRS had not clearly documented the likelihood of each risk in the risk register, making it difficult to understand how likely each risk is to occur after IRS responds to and closes a risk. For example, the PDC program and taxpayers could be harmed if scammers find a way to impersonate collection agencies. IRS set up a Taxpayer Authentication Number to allow taxpayers to verify that a phone call is from a collection agency and not a scammer, and closed the risk involving scams. However, the risk register is unclear on how IRS estimates the likelihood this risk could occur or on how this response would reduce the likelihood of scams. IRS officials said quantifying the impacts and likelihood of some risks is difficult. Even so, without clear documentation on the risk impacts and likelihood, it will be difficult for IRS to prioritize the risks. Without a reasonable measure of the impact’s severity, IRS may be unable to properly select responses to mitigate the potential impacts from the risks. IRS has developed many responses to broadly address taxpayer risks in the PDC program, but has not clearly documented and aligned the responses to address specific risks. Our 2016 report on risk management suggests as a good practice selecting risk responses based on a prioritized list of risks. IRS established risk categories and risk responses that broadly respond to taxpayer risks in the PDC program, such as the quality review process to measure how well collection agency employees properly follow IRS procedures. However, IRS has not addressed all of the elements we described in our 2016 report for selecting responses to risks—in part because identified risks and responses are broad—as IRS has not completed all the steps for risk identification and assessment, as previously discussed. In addition, we found that the risk register did not clearly document the responses chosen to mitigate some stated risks. First, IRS did not always clearly document in the register column for responding to risks how its many responses aligned with a specific risk. For example, the register aligned a response on tracking taxpayer complaints with the risk on protecting taxpayer rights but not with the risk of scams, even though IRS officials said that they rely on TIGTA to monitor taxpayer complaints for PDC-related scams. Second, the register did not include some taxpayer protection responses. Specifically, we identified taxpayer protection responses in the collection agency contracts that were not included in the risk register, such as 1) ensuring that collection agency employees are not paid based on how much they collect, or 2) relying on taxpayers to inform collection agencies if debt payments would cause a hardship. IRS officials acknowledged that their risk register does not align all of its responses with specific risks, but said they created many responses to generally protect taxpayers, although we did not find many of these responses documented in the risk register. Without thorough risk identification and assessment or clear documentation in the risk register of how all risk responses align with specific risks, IRS does not have reasonable assurance that it has properly selected risk responses for each taxpayer risk. IRS has developed monitoring efforts for major taxpayer risk responses for the PDC program, but lacks assurance that specific responses are working effectively to mitigate specific risks. Our prior work encourages agencies to monitor how risks change and how well risk responses work. IRS monitoring includes: reviewing the quality of a statistically reliable sample of calls between collection agencies and taxpayers, reviewing monthly reports from collection agencies on their compliance and behaviors involving taxpayers, periodically visiting collection agencies to review program compliance, acting on referrals from Treasury Inspector General for Tax Administration’s (TIGTA) investigation of complaints, and tracking taxpayer satisfaction through a customer satisfaction survey. However, we found that IRS’s broad monitoring efforts provide limited information on whether or how effectively the responses are addressing taxpayer risks in the PDC program. For example: IRS monitors calls and scores collection agencies’ accuracy in following various collection procedures, but this measure provides little information on how well specific risks in the PDC program are addressed to protect taxpayers. For fiscal year 2017, the quality scores indicated that collection agencies scored at least 98 percent accuracy. However, IRS focuses on this overall score rather than monitoring individual components that make up the overall score, which could serve as possible indicators of taxpayer risks, such as unauthorized disclosures of taxpayer information. IRS documentation showed that IRS is still identifying which components of the quality score apply to collection agency performance on taxpayer rights protection, but IRS officials said they do not plan to finalize the program’s performance measures until fiscal year 2020. IRS has not documented how it uses its customer satisfaction survey measure to monitor specific risks to taxpayer rights. IRS reports that taxpayers’ satisfaction scores for interacting with collection agencies exceed 93 percent overall. However, this overall score does not provide specific information about risks to taxpayers or related risk responses. Some survey questions—such as on collection agency professionalism—could provide information about specific taxpayer risks. IRS has plans to consider using other survey questions as measures and, in October 2018, officials said they are planning analysis in fiscal year 2019 to inform and implement survey changes by fiscal year 2020. IRS expects taxpayers to tell the collection agency if they cannot afford a debt payment, but does not track whether this risk response is effective. If a taxpayer reports to a collection agency that debt payments would cause economic hardship, that they have a medical hardship, or that they receive Social Security Disability Insurance (SSDI) or Supplemental Security Income (SSI), the collection agency is required to return the case to IRS. To start such tracking, IRS officials said they were open to possibly analyzing which types of taxpayers pay or do not pay, as well as the voluntary payment rate on installment agreements for PDC taxpayers. As of October 2018, IRS documentation showed ongoing development of measures for monitoring taxpayer complaints that TIGTA receives and investigates. It showed that IRS proposes to establish thresholds for the number of actionable complaints and unauthorized disclosures a collection agency needs to report before IRS takes corrective action. In addition to TIGTA complaints, we found that IRS has other sources of taxpayer complaints available that it was not using to monitor changes in taxpayer risk. The Federal Trade Commission’s (FTC) Consumer Sentinel Database received a number of taxpayer complaints about collection agencies and possible scams, but we found that IRS did not ask FTC for these data. FTC gathers data on complaints from the public, the Better Business Bureau, and IRS and other federal and state agencies. We analyzed FTC data from about the first 15 months of the PDC program and identified 20 PDC-related taxpayer complaints. More than half of the complaints indicated taxpayer confusion after being contacted by a collection agency; of these, seven taxpayers mistook the collection agencies for scammers. In addition, six cases were possible scams, and in three cases taxpayers reported harassment by the collection agency. When we shared our analysis with IRS officials, they agreed that the FTC data would be valuable to them and said they plan to work with TIGTA’s Office of Investigations to incorporate these data into their monitoring of taxpayer complaints by the end of March 2019. Although IRS has developed methods to monitor its risk responses involving taxpayer risks and taxpayer rights violations, IRS’s monitoring provides broad indicators rather than specific measures on how well responses address each risk in the PDC program. Although officials are considering changes to IRS’s monitoring and have plans to conduct data analysis in fiscal year 2019 to inform decisions about possible customer satisfaction survey changes, until these changes are implemented, IRS will have limited assurance that it has effective responses to address each risk in the PDC program. IRS informs internal stakeholders and Congress about taxpayer risks in the PDC program, but has not fully engaged external stakeholder groups that represent taxpayers’ interests to learn about risks. Our 2016 report on risk management discussed the need to inform internal and external stakeholders about program risks and risk response performance, and to seek feedback on risks from stakeholders. We found that IRS followed some of these practices and conducted outreach to some internal and external stakeholders. For example, PDC management engages regularly with IRS stakeholders, and produces annual reports to Congress on PDC performance including taxpayer protection. IRS officials said that IRS staff regularly meet with the Taxpayer Advocate Service (TAS) staff on PDC. However, TAS has recommended that it be involved in overseeing taxpayer protection procedures by reviewing collection agency calls with taxpayers. IRS officials said they also reached out to external stakeholders such as practitioner groups and Low-Income Taxpayer Clinics through conferences and the Office of National Public Liaison, and participated in Nationwide Tax Forums to provide “limited talking points” about the PDC program. IRS provided documents showing prior outreach to these groups as well as AARP about the PDC program. In addition, IRS provided documents showing planned outreach to external stakeholders for fiscal year 2019, including TAS, Congress, tax preparers, and tax professional groups. IRS officials said they welcome feedback about taxpayer risks, but documents they provided showed limited efforts to solicit feedback from external stakeholders about the PDC program. For example, between May 2016 and October 2018, IRS anonymously recorded 26 questions from external stakeholders through its Stakeholder Liaison office, which is designated to communicate with stakeholders. Ten of these questions were recorded after April 21, 2017, when collection agencies started contacting taxpayers directly about their tax debts. Because the identities of stakeholders submitting questions are kept anonymous, we could not follow up with stakeholders about IRS’s responses. IRS officials said they had not received any direct feedback from Low Income Taxpayer Clinics, but that any such feedback would be shared through TAS. Our interviews with external stakeholders from practitioner groups and groups that represent taxpayer interests indicated that IRS had not offered them clear opportunities to provide feedback. For example, several Low Income Taxpayer Clinic officials informed us that they did not perceive that IRS was soliciting their feedback when the PDC topic was discussed at conferences and meetings they attended. We received similar comments that feedback opportunities were lacking or unclear from representatives at AARP, the American Bar Association, and other groups, raising questions about how fully IRS solicited feedback while conducting its outreach on the PDC program. As previously mentioned, we learned about taxpayer risks IRS did not include in its risk register and the experiences of vulnerable groups by reaching out to stakeholders and listening to their stories (see figure 3). For example, some stakeholders expressed concerns that using collection agencies could increase scam risk and make it more difficult to advise taxpayers on how to avoid scams. They also identified a range of risks to various types of vulnerable taxpayers. For example, stakeholders told us that low-income taxpayers can be risk averse and will try to pay, and may be unaware they do not have to pay the debt if it will cause a hardship. According to some of the groups we interviewed, some elderly taxpayers are particularly vulnerable to scams and could be easier for collection agencies to pressure into payment arrangements; other types of taxpayers might be confused and believe that a legitimate collection agency call is actually a scam. While we did not encounter clear examples of taxpayer mistreatment by collection agencies or scammers impersonating collection agencies, the concerns stakeholders raised suggest they can provide IRS with feedback and insights about taxpayer risks—particularly to vulnerable groups—that IRS may not identify on its own. Without ensuring that it has fully solicited feedback and conducted outreach to stakeholders, IRS does not have assurance that it has identified specific risks to taxpayers and appropriately responded to them. IRS identified scams as a risk to the PDC program and taxpayers. In response to the scam risk, IRS established a Taxpayer Authentication Number to help taxpayers and collection agencies verify each other’s identities, provided authentication guidance to taxpayers with cases assigned to collection agencies, and posted scam alerts and press releases on its website. In addition, TIGTA monitors taxpayer complaints to identify instances of scams, according to IRS officials. Beyond this step, IRS has not identified other fraud risks, such as those internal to the operation of PDC. To help agencies better address fraud, we issued A Framework for Managing Fraud Risks in Federal Programs (Fraud Risk Framework), which includes a comprehensive set of leading practices to combat fraud in a strategic, risk-based manner. These practices include: identifying and assessing inherent fraud risks—including fraud risks within the program, examining the suitability of existing fraud controls, and documenting the program’s fraud risk profile. IRS did not have information to demonstrate a formal fraud risk assessment for the PDC program. IRS officials said they did not conduct and document a formal fraud risk assessment because they considered fraud risk as part of their risk management process for the PDC program. However, IRS’s risk register did not identify fraud types beyond scams, and our review of other IRS risk management documents found that they had no clear information about consideration of other external or internal fraud risks, such as from collection agency employees. In addition, IRS did not document responses to address fraud risks beyond the Taxpayer Authentication Number and scam-related complaints monitoring. Without information on IRS’s assessment and responses to fraud risks it is not clear that IRS fully considered internal and external fraud risks, or developed appropriate responses to those risks, meaning IRS cannot provide assurance it is effectively managing fraud risks to taxpayers and the program. IRS assures taxpayers that they can expect the same level of service and protections from collection agencies as they do from IRS collections. However, we identified two inconsistencies in IRS guidance on taxpayer protections for the PDC program, which could increase confusion among taxpayers or risks to taxpayers. In response to our findings, IRS is revising its guidance to address one of these issues but the other has not been addressed. Responding to suicidal taxpayers: IRS guidance for its collection employees requires them to take all taxpayer suicide threats seriously, keep the taxpayer on the phone, and act quickly to report the incident to authorities to locate and help the taxpayer. However, IRS guidance for collection agency staff allowed debt collectors to first use judgment to try and determine if the suicide threat was sincere before taking steps to help the taxpayer. When we pointed out this discrepancy to IRS officials, they acknowledged it and, in October 2018, issued revised guidance to collection agencies that removed collector discretion to judge whether suicide threats are valid before taking actions to help the taxpayer. Reporting scams to TIGTA: IRS instructs taxpayers to call TIGTA if they suspect a scam. IRS information mailed to taxpayers and on the main PDC program website includes contact information for TIGTA, but does not say to call TIGTA to report a scam. This information is found separately on IRS’s website for scams—which can be accessed through the main PDC program website—but this may not be clear to all taxpayers in the PDC program. IRS officials acknowledged that their mailed publications do not instruct taxpayers to contact TIGTA to report scams, but said they encourage taxpayers to visit IRS.gov to keep informed about scams. External stakeholders including AARP and the National Center on Elder Abuse said that older Americans generally trust and rely more upon the mail than the internet. In addition, because older Americans are more likely to watch televised news, they may not necessarily see IRS website scam alerts and therefore may be less aware of these scams. They also said that not all taxpayers—in particular elderly taxpayers—use the internet, and thus rely on printed guidance or the telephone for information about reporting scams. Without clear guidance, taxpayers will not know how to report scams. Thus, TIGTA and IRS may be unaware of and unable to appropriately respond to them. IRS officials said it would be possible to update the printed guidance provided to taxpayers with information about contacting TIGTA to report scams, but that such revisions could take up to a year to implement. The PDC program can contribute to IRS’s enforcement efforts to assure taxpayer compliance and help address the tax gap. However, without program objectives that are clearly defined and consistently stated, IRS cannot assure that appropriate controls will be in place to address risks. Also, without measures and targets that are clearly linked to program objectives, IRS will be limited in assessing progress and assuring that the program achieves its objectives. Without complete reporting on the PDC program revenue collection results, Congress is not fully informed on the amounts of collected revenue sent to the general fund of the Treasury and amounts retained by IRS to pay costs. In addition, IRS’s not reporting TIGTA’s costs to administer the PDC taxpayer complaint system means Congress is not informed of full PDC program costs. Furthermore, because IRS does not have plans to analyze data to identify ways to improve the results of the PDC program by using its discretion to revise the types of tax debt cases it sends to collection agencies, IRS risks continuing to send cases to collection agencies that incur costs but collect little or no revenue. IRS may also miss opportunities to assign cases that collect more revenue to more efficiently and effectively address the gap between what taxpayers owe and pay. IRS’s incomplete documentation of how taxpayer risks align with program objectives, identification of risks, and risk assessment make it difficult for IRS to prioritize risks, and does not provide reasonable assurance that IRS properly selected risk responses to address each risk. Similarly, not fully documenting how IRS is monitoring taxpayer risks and related responses means that IRS has limited assurance that each response is effective in addressing the risk. Taxpayers may face increased risk if IRS guidance to taxpayers is unclear, such as how to report scams. Lastly, more fully soliciting feedback from external stakeholders to learn about taxpayer risks—particularly to vulnerable groups—would provide assurance that IRS has identified and appropriately responded to taxpayer risks. We are making the following 12 recommendations to the Commissioner of Internal Revenue: The Commissioner of Internal Revenue should finalize the PDC program objectives so that they are clearly defined in consistent terms, and assure that the key program risks, measures, and targets are linked with the objectives. (Recommendation 1) The Commissioner of Internal Revenue should include TIGTA costs in IRS’s reporting of PDC program costs. (Recommendation 2) The Commissioner of Internal Revenue should report the amount of collected revenue sent to the general fund of the Treasury and amounts retained by IRS to pay its costs. (Recommendation 3) The Commissioner of Internal Revenue should analyze PDC program results to identify the types of cases that are not potentially collectible and should not be assigned to collection agencies. (Recommendation 4) The Commissioner of Internal Revenue should analyze PDC program results and the cases not assigned to the PDC program to identify the types of inactive cases IRS will not pursue that could be assigned to collection agencies to improve PDC program results. (Recommendation 5) The Commissioner of Internal Revenue should clearly document and distinguish the complete list of identified risks to taxpayers in the PDC program risk register, and align the risks with PDC program objectives. (Recommendation 6) The Commissioner of Internal Revenue should clearly document the severity of impacts of the taxpayer risks, as well as the likelihood of each taxpayer risk after responding to it, in the PDC program risk register, and use this information to prioritize risks to address and guide selection of risk responses. (Recommendation 7) The Commissioner of Internal Revenue should clearly document how each risk response aligns with specific taxpayer risks in the PDC program risk register. (Recommendation 8) The Commissioner of Internal Revenue should document how IRS’s monitoring of the PDC program provides information on specific taxpayer risks and how well specific responses are working to address each risk, and should supplement IRS’s monitoring of taxpayer complaints with FTC complaint data. (Recommendation 9) The Commissioner of Internal Revenue should more fully seek and document feedback from external stakeholders representing vulnerable taxpayers to identify and appropriately respond to possible PDC taxpayer risks. (Recommendation 10) The Commissioner of Internal Revenue should clearly document an assessment of fraud risks related to the PDC program. (Recommendation 11) The Commissioner of Internal Revenue should ensure that its printed guidance to PDC taxpayers includes information about reporting scams to TIGTA. (Recommendation 12) We provided a draft of this report to the Commissioner of Internal Revenue for comment. IRS provided written comments, which are reproduced in appendix III. Of our twelve recommendations, IRS partially agreed with one and disagreed with two. IRS agreed with the remaining nine recommendations and outlined actions to implement them. Of these nine recommendations, IRS said it already implemented one and planned to implement another, even though IRS disagreed with part of the related finding. IRS partially agreed with our recommendation on defining PDC program objectives related to key risks and developing related measures and targets (Recommendation 1). IRS said it would use consistent terms in developing measures that link to its PDC program objectives, but did not agree that program objectives are necessarily framed in terms of program risks. IRS said its approach to risk management is consistent with GAO’s Standards for Internal Control in the Federal Government, which is to identify objectives before identifying risks to achieving those objectives. However, IRS did not document the program’s objectives until October 2018, about two years after it validated identified PDC program risks, and did not expect to finalize the objectives and related measures and targets until fiscal year 2020 or later. Further, as discussed in the report, IRS’s stated objectives did not acknowledge all key PDC program risks, such as scams and high costs compared to revenue collected. We revised the recommendation to more clearly address our intent that whenever IRS finishes defining the PDC program objectives, IRS should ensure that they include objectives that are linked with key program risks. IRS disagreed with our recommendation that IRS include TIGTA costs in reporting program costs (Recommendation 2). IRS said that doing so would be inconsistent with legislative requirements that define program costs as IRS’s costs and with IRS cost-accounting practices. However, the FAST Act set minimum reporting requirements to which IRS can add more information. Also, the existing cost accounting standards and practices to which IRS refers govern IRS’s accounting for and reporting of costs incurred by IRS. However, our intent is to ensure fuller reporting of the PDC program’s cost to the federal government. Therefore we stand by our recommendation because without such reporting Congress is not informed of full PDC program costs. IRS also disagreed that it should analyze PDC program results to identify the types of cases that are not potentially collectible and therefore should not be assigned to collection agencies (Recommendation 4). IRS said the PDC statute requires the assignment of all inactive tax receivables to collection agencies and therefore no collectability analysis is required or necessary. However, as we discuss in our report, the statute defines “inactive tax receivables” as being in “potentially collectible inventory” but does not define “potentially collectible inventory.” We also noted that IRS has the discretion to define “potentially collectible inventory” under its general rulemaking authority in 26 U.S.C. § 7805 and can use this authority to determine which cases are potentially collectible and which are not. IRS also said it questioned whether the analysis we recommend would improve efficiency and said there is very little cost associated with assigning additional cases to collection agencies. During our review, we asked IRS for such cost information and IRS officials said they did not know the costs to send or to handle returned PDC cases. As we noted in our report, IRS has incurred tens of millions of dollars in costs with little or no revenue collected for most of the PDC cases that IRS has closed. IRS analysis to improve PDC case assignment could improve efficiency. Under its general rulemaking authority, IRS is authorized to make rules it deems necessary for the efficient administration of the tax code. We added language in the report to emphasize IRS’ management responsibility to assure efficient program operations. Without the analysis we recommend, IRS could continue assigning uncollectible debts to PCAs that generate IRS costs and waste federal resources. IRS agreed that it should analyze PDC program results and the cases not assigned to the PDC program to identify the types of inactive cases that could be assigned to collection agencies to improve PDC program results (Recommendation 5). IRS said it had already built this analysis into its current shelving process, as the statue addresses inactive cases that are shelved due to lack of resources. However, it is not clear that the analysis embedded into IRS’s shelving process identifies cases that IRS will not pursue and assigns them to collection agencies before the 52-week shelving threshold, or before the FAST Act’s case age requirements, as we discuss in the report. Similarly, it is not clear that IRS’s shelving process includes analysis of PDC results to identify characteristics of cases with the highest collection results and uses that analysis to find inactive cases with similar characteristics that could be assigned to collection agencies, as we discuss in the report. We look forward to IRS taking actions that will address our findings. Without such analyses, IRS could miss opportunities to assign cases that collect more revenue than cases that collection agencies return with little or no revenue collected. Finally, although IRS agreed with our recommendation that it report the amount of collected revenue sent to the general fund of the Treasury and amounts retained by IRS to pay its costs (Recommendation 3), IRS said it disagreed that its reports to Congress on the PDC program have not provided complete financial information and said such reporting followed statutory requirements. As we state in our report, IRS has documented PDC revenue collections and costs in its annual report to Congress as required by the FAST Act. However, although not required by the Act, IRS has reported the program balance measure—program revenue less cost—without clarifying how much revenue goes to the general fund of the Treasury (the Treasury) rather than to IRS’s two funds. We appreciate IRS’s agreement with this recommendation as well as its plans to report PDC revenue amounts going to the Treasury and to IRS’s retained funds. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies of this report to the appropriate congressional committees, the Secretary of the Treasury, the Commissioner of Internal Revenue, and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-9110 or at lucasjudyj@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix IV. The objectives of this report were to assess the extent to which the Internal Revenue Service (IRS) has (1) documented Private Debt Collection (PDC) program objectives and measures; (2) documented data on PDC revenue collection and cost results, and used these data to improve the program and meet its objectives; and (3) addressed PDC program risks to prevent or address scams or other harmful effects on taxpayers. We limited the scope of our analysis to PDC program planning and implementation, PDC program data on costs and revenues, and risks to taxpayers in the PDC program. To assess the extent to which IRS documented PDC program objectives and measures, we reviewed PDC program management documents and interviewed IRS officials—including the Director of Headquarters Collection and the PDC Program Manager—to identify the stated objectives and proposed measures to support identification of program risks and assess program performance. We compared the program objectives and measures to criteria in federal internal control standards for defining objectives, including standards that objectives be clearly defined to enable risk identification in specific and measurable terms with measures and related targets to allow assessment of program performance. We assessed the clarity of links between the IRS’s stated PDC program objectives and proposed program performance measures. We also interviewed IRS officials and reviewed program documents to assess the extent to which PDC program objectives were linked to acknowledged key program risks. Finally, we compared IRS’s documented objectives statements to assess consistency in their terms. To assess the extent to which IRS has documented data on PDC revenue collections and costs, we compared IRS’s reporting of PDC costs and revenue collections data to criteria in federal internal control standards, including standards that management should externally communicate complete, quality information necessary to achieve objectives, including objectives for reporting financial information. We assessed the extent to which IRS’s reporting of its program balance measure was complete in reporting program’s results for revenue collected and costs to include how much of the collected revenue goes to the general fund of the Treasury, and how much IRS is retains to pay for related costs. We also assessed the completeness of IRS cost reporting to include the Treasury Inspector General for Tax Administration costs for administering the system for taxpayer complaints about collection agencies. To assess the extent to which IRS is using costs and revenue collect data to improve the PDC program and meet objectives, we compared IRS’s program administration plans to criteria in federal internal control standards that management use quality data to achieve objectives, our work showing that using performance data helps agencies achieve better results, and IRS strategic goals. We also assessed the extent to which IRS had legal authority to revise the types of cases it assigns to collection agencies, and to what extent it had plans to analyze data to revise case assignments to minimize costs and maximize collection revenue results. To assess the extent to which the PDC program addressed risks to taxpayers, we reviewed risk management criteria from one of our previous publications on enterprise risk management (ERM), guidance from the Office of Management and Budget Circular A-123, the Fraud Reduction and Data Analytics Act, and our Fraud Risk Framework. We then applied these criteria to the PDC program risk register for the taxpayer risks. We believe this was appropriate because IRS follows an ERM process to manage taxpayer risks as well as other program risks that were not part of our work. We did not assess IRS’s overall approach to applying its ERM process. To identify taxpayer risks and understand the program’s risk responses, we reviewed the risk register, the collection agency Policy and Procedures Guide, collection agency contracts, and other program documentation and analyzed data on cases collection agencies returned to IRS. We also interviewed IRS officials involved in PDC, including the Director of Headquarters Collection and PDC Program Manager in IRS’s Small Business/Self-Employed operating division, and solicited feedback from external stakeholders—such as Low-Income Taxpayer Clinics and groups dealing with elder fraud and abuse issues—that represent vulnerable taxpayers to learn about risks, and analyzed FTC data on taxpayer complaints. We also reviewed PDC program performance data on quality reviews, taxpayer satisfaction, and taxpayer complaints to understand how IRS monitors taxpayer risks and responses. Lastly, while reviewing program documents, we noted inconsistencies between PDC program guidance for collection agencies and IRS collection procedures that arose during our review, and verified these inconsistencies with IRS officials. We conducted this performance audit from January 2018 to March 2019 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Table 2 shows the overall private debt collection (PDC) program’s revenue collections and cost data the Internal Revenue Service (IRS) used to calculate and report the PDC program balance measure through September 30, 2018, along with additional detailed information (in bold) that IRS did not include in the program balance table it reported to Congress. The added information shows the amounts that went to the general fund of the Treasury and the amounts of commissionable collections that went to IRS to pay costs to contract for PDC and hire additional collection staff in the future. Table 3 shows the status of the two IRS retained funds for fiscal years 2017 and 2018; these funds had no activity during fiscal year 2016 because IRS had not yet sent any cases to the private collection agencies to be worked. Table 4 shows IRS’s reporting of its PDC program costs for fiscal years 2016 through 2018, including the costs that IRS incurred before IRS started sending tax debt cases to private collection agencies in April 2017. Jessica Lucas-Judy, (202) 512-9110 or lucasjudyj@gao.gov. In addition to the contact named above, Tom Short (Assistant Director), Ronald W. Jones (Analyst-in-Charge), Carole J. Cimitile, Charles Fox, Robert Gebhart, James Andrew Howard, Edward Nannenhorn, William M. Reinsberg, Robert Robinson, Cynthia Saunders, Rebecca Shea, Margie K. Shields, and Adam Windram made key contributions to this report.

Summary: IRS attempts to collect tax debts to promote tax compliance but does not have resources to pursue all debts. A 2015 law required IRS to contract with private collection agencies for certain tax debts. However, stakeholders such as the National Taxpayer Advocate have noted that safeguards are needed to protect taxpayers from risks, such as scammers impersonating collection agencies. GAO was asked to review IRS's PDC program. This report assesses the extent to which IRS (1) documented program objectives and measures, (2) documented revenue collection and cost results data, (3) used data to improve the program and meet its objectives, and (4) addressed risks to prevent or address scams and other harmful effects on taxpayers. GAO analyzed IRS's documents on PDC program administration and planning; collections and costs reporting; and managing risks. GAO interviewed officials from IRS and external groups that represent taxpayer interests. The Internal Revenue Service (IRS) documented objectives and proposed measures for its private debt collection (PDC) program for sending tax debt cases to private collection agencies, but the objectives are not clearly defined and their linkages with program measures are unclear. For example, one objective is to provide taxpayers an opportunity to understand and resolve their tax debts, but the proposed measure focuses on taxpayer satisfaction with collection agencies rather than taxpayers' understanding. The objectives also do not include some key program risks, such as scams. Without clearly defined objectives and measures, IRS will have limited ability to assess program results. IRS's reports to Congress on the PDC program have not provided complete financial information. For example, as of September 2018, IRS reported program revenue collections of about $89 million and costs of $67 million, suggesting a positive balance of $22 million for the general fund of the Treasury (the Treasury). However, the report did not clarify that about $51 million collected went to the Treasury and the remaining $38 million were retained by IRS in two special funds to pay current and future program costs. Without this information, Congress has an incomplete picture of the program's true costs and revenues. IRS has not analyzed PDC program results to identify the types of cases that should not be assigned to collection agencies because they do not result in collections. GAO's analysis of IRS data shows that between April 2017 and September 2018 about 73,000 of 111,000 cases closed by collection agencies had little or no revenue collected because the collection agencies were unable to contact the taxpayer or collect the debt, among other reasons. Given the costs associated with managing these cases, without such analyses, IRS may continue to use resources inefficiently and assign cases with little or no potential for revenue collection, or miss opportunities to assign other cases that could produce more revenue. IRS has identified and taken steps to mitigate some PDC program risks that could harm taxpayers. However, IRS has not completed the process of identifying and documenting all risks nor has it fully assessed risks to taxpayers from the program or its response to these risks. Specifically, GAO found that IRS identified and documented 6 taxpayer risks related to the PDC program, such as scammers impersonating collection agencies, but had not identified an additional 10 risks that GAO did, such as taxpayers agreeing to debt payments they cannot afford. IRS had not consistently assessed the impact or likelihood of the identified risks. As a result, IRS's responses to mitigate risks were broad in nature, and were not prioritized or aligned to address specific risks. IRS monitors a sample of collection agencies' telephone calls with taxpayers and reviews taxpayer complaints, but these methods do not provide information on whether IRS's responses to risks are effective. Without addressing these risk management issues, IRS cannot ensure it has fully identified PDC program risks and effectively responded to protect taxpayers from them. GAO makes 12 recommendations, including that IRS improve PDC program objectives and measures, revenue and cost reporting, analysis to assign cases, and management of taxpayer risks. IRS agreed with nine recommendations, partially agreed with GAO's recommendation on improving objectives—which GAO clarified in response—and disagreed with two recommendations to include certain costs in reporting and analyze data to identify cases not collectible. GAO maintains the recommendations would more fully report PDC program federal costs and prevent waste.