Internal control is not one event, but a series of actions and activities that occur throughout an entity’s operations and on an ongoing basis. Internal control should be recognized as an integral part of each system that management uses to regulate and guide its operations rather than as a separate system within an agency. In this sense, internal control is management control that is built into the entity as a part of its infrastructure to help managers run the entity and achieve their goals on an ongoing basis. Section 3512 (c), (d) of Title 31, U.S. Code, commonly known as the Federal Managers’ Financial Integrity Act of 1982 (FMFIA), requires agencies to establish and maintain internal control. The agency head must annually evaluate and report on the control and financial systems that protect the integrity of federal programs. The requirements of FMFIA serve as an umbrella under which other reviews, evaluations, and audits should be coordinated and considered to support management’s assertion about the effectiveness of internal control over operations, financial reporting, and compliance with laws and regulations. Office of Management and Budget (OMB) Circular No. A-123, Management’s Responsibility for Internal Control, provides the implementing guidance for FMFIA, and sets out the specific requirements for assessing and reporting on internal controls consistent with the internal control standards issued by the Comptroller General of the United States. The circular defines management’s responsibilities related to internal control and the process for assessing internal control effectiveness, and provides specific requirements for conducting management’s assessment of the effectiveness of internal control over financial reporting. The circular requires management to annually provide assurances on internal control in its performance and accountability report, and for each of the 24 Chief Financial Officers Act agencies to include a separate assurance on internal control over financial reporting, along with a report on identified material weaknesses and corrective actions. The circular also emphasizes the need for integrated and coordinated internal control assessments that synchronize all internal control-related activities. FMFIA requires GAO to issue standards for internal control in the federal government. The Standards for Internal Control in the Federal Government (i.e., internal control standards) provides the overall framework for establishing and maintaining effective internal control and for identifying and addressing major performance and management challenges and areas at greatest risk of fraud, waste, abuse, and mismanagement. As summarized in the internal control standards, the minimum level of quality acceptable for internal control in the government is defined by the following five standards, which also provide the basis against which internal controls are to be evaluated: Control environment: Management and employees should establish and maintain an environment throughout the organization that sets a positive and supportive attitude toward internal control and conscientious management. Risk assessment: Internal control should provide for an assessment of the risks the agency faces from both external and internal sources. Control activities: Internal control activities help ensure that management’s directives are carried out. The control activities should be effective and efficient in accomplishing the agency’s control objectives. Information and communications: Information should be recorded and communicated to management and others within the entity who need it and in a form and within a time frame that enables them to carry out their internal control and other responsibilities. Monitoring: Internal control monitoring should assess the quality of performance over time and ensure that the findings of audits and other reviews are promptly resolved. The third control standard—control activities—helps ensure that management’s directives are carried out. Control activities are the policies, procedures, techniques, and mechanisms that enforce management’s directives. In other words, they are the activities conducted in the everyday course of business that are intended to accomplish a control objective, such as ensuring IRS employees successfully complete background checks prior to being granted access to taxpayer information and receipts. As such, control activities are an integral part of an entity’s planning, implementing, reviewing, and accountability for stewardship of government resources and achievement of effective results. A key objective in our annual audits of IRS’s financial statements is to obtain reasonable assurance about whether IRS maintained effective internal controls with respect to financial reporting, including safeguarding of assets, and compliance with laws and regulations. While we use all five internal control standards as a basis for evaluating the effectiveness of IRS’s internal controls, we place a heavy emphasis on testing control activities. Our evaluations and tests have resulted in the identification of issues in certain internal controls over the years and recommendations for corrective action. To accomplish our objectives, we evaluated the effectiveness of IRS’s corrective actions implemented in response to open recommendations during fiscal year 2007 as part of our fiscal years 2007 and 2006 financial audits. To determine the current status of the recommendations, we (1) obtained IRS’s reported status of each recommendation and corrective action taken or planned as of April 2008, and (2) compared IRS’s reported status to our fiscal year 2007 audit findings to identify any differences between IRS’s and our conclusions regarding the status of each recommendation. In order to determine how these recommendations fit within IRS’s management and internal control structure, we compared the open recommendations, and the issues that gave rise to them, to the control activities listed in the internal control standards and to the list of major factors and examples outlined in our Internal Control Management and Evaluation Tool. We also considered how the recommendations and the underlying issues were categorized in our prior reports; whether IRS had addressed, in whole or in part, the underlying control issues that gave rise to the recommendations; and other legal requirements and implementing guidance, such as OMB Circular No. A-123; FMFIA; and the Federal Information System Controls Audit Manual (FISCAM). Our work was performed from December 2007 through May 2008 in accordance with generally accepted government auditing standards. We requested comments on a draft of this report from the Commissioner of Internal Revenue or his designee on June 9, 2008. We received comments from the Commissioner on June 24, 2008. IRS continues to make progress addressing its significant financial management challenges. Over the years since we first began auditing IRS’s financial statements in fiscal year 1992, IRS has taken actions enabling us to close over 200 of our financial management-related recommendations. This includes 18 recommendations we are closing based on actions IRS took during the period covered by our fiscal year 2007 financial audit. At the same time, however, our audits continue to identify additional internal control issues, resulting in our making further recommendations for corrective action, including 24 new financial management-related recommendations resulting from our fiscal year 2007 financial audit. These internal control issues, and the resulting recommendations, can be directly traced to the control activities in the internal control standards. As such, it is essential that they be fully addressed and resolved to strengthen IRS’s overall financial management and to assist it in efficiently and effectively achieving its goals and mission. In June 2007, we issued a report on the status of IRS’s efforts to implement corrective actions to address financial management recommendations stemming from our fiscal year 2006 and prior year financial audits and other financial management-related work. In that report, we identified 75 audit recommendations that at that time remained open and thus required corrective action by IRS. A significant number of these recommendations had been open for several years, either because IRS had not taken corrective action or because the actions taken had not yet fully and effectively resolved the issues that gave rise to the recommendations. IRS continued to work to address many of the internal control issues to which these open recommendations relate. In the course of performing our fiscal year 2007 financial audit, we identified numerous actions IRS took to address many of its internal control issues. On the basis of IRS’s actions, which we were able to substantiate through our audit, we are able to close 18 of these prior years’ recommendations. IRS considers another 23 of the prior years’ recommendations to be effectively addressed. However, we still consider them to be open either because we had not yet been able to verify the effectiveness of IRS’s actions—they occurred subsequent to completion of our audit testing and thus have not been verified, which is a prerequisite to our closing a recommendation—or because the actions taken did not fully address the issue that gave rise to the recommendation. However, continued efforts are needed by IRS to address its internal control issues. While we are able to close 18 financial management recommendations made in prior years, 57 recommendations from prior years remain open, a significant number of which have been outstanding for several years. In some cases, IRS may have effectively addressed the issues that gave rise to the recommendations subsequent to our fiscal year 2007 audit testing. However, in many cases, we determined based on the work performed for our fiscal year 2007 audit that IRS’s actions taken to date had not yet fully and effectively addressed the underlying internal control issues. Additionally, during our audit of IRS’s fiscal year 2007 financial statements, we identified additional issues that require corrective action by IRS. In a recent management report to IRS, we discussed these issues, and made 24 new recommendations to IRS to address them. Consequently, a total of 81 financial management-related recommendations were open at the end of fiscal year 2007 and need to be addressed by IRS. While most of our open recommendations can be addressed in the short term, a few recommendations, particularly those concerning IRS’s automated systems, are complex and will require several more years to fully and effectively address. We consider 71 recommendations to be short-term and 10 to be long-term. In addition to the 81 open recommendations from our financial audits and other financial management-related work, we have 76 open recommendations as a result of our assessment of IRS’s information security controls over key financial systems, data, and interconnected networks at IRS’s critical data processing facilities. One of those open recommendations relates to IRS’s need to implement an agencywide information security program, the lack of which was a key reason for the material weakness in IRS’s information systems security controls over its financial and tax processing systems.