Internal control is not one event, but rather a series of activities that should occur throughout an entity’s operations and on an ongoing basis. Internal control should be an integral part of each system that management uses to regulate and guide its operations, rather than as a separate system within an agency. In this sense, internal control is management control that should be built into the entity as a part of its infrastructure to help managers run the entity and achieve their goals on an ongoing basis. Section 3512 (c), (d) of Title 31, U.S. Code, commonly known as the Federal Managers’ Financial Integrity Act of 1982 (FMFIA), requires agencies to establish and maintain effective internal control. The agency head must annually evaluate and report on the control and financial systems that protect the integrity of its federal programs. The requirements of FMFIA serve as an umbrella under which other reviews, evaluations, and audits should be coordinated and considered to support management’s assertion about the effectiveness of internal control over operations, financial reporting, and compliance with laws and regulations. Office of Management and Budget (OMB) Circular No. A-123, Management’s Responsibility for Internal Control, provides the implementing guidance for FMFIA, and prescribes the specific requirements for assessing and reporting on internal controls consistent with the Standards for Internal Control in the Federal Government (internal control standards) issued by the Comptroller General of the United States. The circular defines management’s responsibilities related to internal control and the required process for assessing internal control effectiveness, and provides specific requirements for conducting management’s assessment of the effectiveness of internal control over financial reporting. The circular requires management to annually provide assurances on internal control and emphasizes the need for integrated and coordinated internal control assessments that synchronize all internal control–related activities. FMFIA requires GAO to issue standards for internal control in the federal government. The internal control standards provide the overall framework for establishing and maintaining effective internal control and for identifying and addressing major performance and management challenges and areas at greatest risk of fraud, waste, abuse, and mismanagement. As summarized in the internal control standards, internal control in the government is defined by the following five elements, which also provide the basis against which internal controls are to be evaluated: Control environment: Management and employees should establish and maintain an environment throughout the organization that sets a positive and supportive attitude toward internal control and conscientious management. Risk assessment: Internal control should provide for an assessment of the risks the agency faces from both external and internal sources. Control activities: Internal control activities help ensure that management’s directives are carried out. The control activities should be effective and efficient in accomplishing the agency’s control objectives. Information and communication: Information should be recorded and communicated to management and others within the entity who need it and in a form and within a time frame that enables them to carry out their internal control and other responsibilities. Monitoring: Internal control monitoring should assess the quality of performance over time and ensure that the findings of audits and other reviews are promptly resolved. A key objective in our annual audits of IRS’s financial statements is to obtain reasonable assurance that IRS maintained effective internal control with respect to financial reporting. While we use all five elements of internal control, including risk assessment and monitoring, as a basis for evaluating the effectiveness of IRS’s internal controls, our ongoing evaluations and tests have focused heavily on control activities, where we have identified numerous control deficiencies and have provided recommendations for corrective action. Control activities are the policies, procedures, techniques, and mechanisms that are intended to enforce management’s directives. In other words, they are the activities conducted in the everyday course of business that are intended to accomplish a control objective, such as ensuring IRS employees successfully complete background checks prior to being granted access to taxpayer information and receipts. Control activities are an integral part of an entity’s planning, implementing, reviewing, and accountability for stewardship of government resources and achievement of effective results. To accomplish our objectives, we evaluated the effectiveness of corrective actions IRS implemented during fiscal year 2011 in response to open recommendations as part of our fiscal years 2011 and 2010 financial audits. To determine the status of the recommendations, we (1) obtained IRS’s reported status of each recommendation and corrective action taken or planned as of March 2012, (2) compared IRS’s reported status to our fiscal year 2011 audit findings to identify any differences between IRS’s and our conclusions regarding the status of each recommendation, and (3) performed additional follow-up work to assess IRS’s actions taken to address the open recommendations. Because of the sensitive nature of many of the issues related to our recommendations regarding information security, we have reported our recommendations for corrective action related to information security issues to IRS separately. GAO, Management Report: Improvements Are Needed to Enhance the Internal Revenue Service’s Internal Controls and Operating Effectiveness, GAO-12-683R (Washington, D.C.: June 25, 2012). IRS had addressed, in whole or in part, the underlying control deficiencies that gave rise to the recommendations; and other legal requirements and implementing guidance, such as FMFIA and OMB Circular No. A-123. Our work was performed from December 2011 through April 2012 in accordance with generally accepted government auditing standards. IRS continues to make progress in resolving its control deficiencies and addressing outstanding recommendations, but continues to face significant financial management challenges. Since we first began auditing IRS’s financial statements in fiscal year 1992, IRS has taken a significant number of actions that were sufficient to resolve several material weaknesses and significant control deficiencies and to close over 300 of our previously reported recommendations. This includes 38 recommendations we are closing with this report based on actions IRS took through March 2012. Nevertheless, IRS continues to face challenges in establishing effective controls over its financial and operational management. Specifically, IRS continues to face management challenges in (1) resolving its two material weaknesses and one significant deficiency in internal control and (2) developing performance measures necessary to managing operational performance outcomes. Further, as in previous years’ audits, our fiscal year 2011 audit continued to identify additional internal control deficiencies, resulting in 30 new recommendations for corrective action. These deficiencies and related recommendations are discussed in detail in our June 2012 management report to IRS. In addition, as noted earlier, we also identified control deficiencies related to information security during our fiscal year 2011 audit that we reported separately with limited distribution because of the sensitive nature of many of those control deficiencies. As in past years, IRS continued to face significant challenges in resolving its remaining long-standing material weaknesses in internal control concerning (1) unpaid assessmentsyear 2011. and (2) information security in fiscal IRS’s continuing challenge in addressing its material weakness in internal control over unpaid assessments results from its (1) inability to rely on its general ledger and underlying subsidiary records to report federal taxes receivable, compliance assessments, and writeoffs in accordance with federal accounting standards without significant compensating procedures; (2) inability to trace reported taxes receivable to supporting transactions and maintain an effective transaction-based subledger for unpaid assessment transactions; and (3) inability to effectively prevent or timely detect and correct errors in taxpayer accounts. These control deficiencies are caused primarily by IRS’s continued reliance on software applications that were not designed to provide accurate, complete, and timely transaction-level financial information, as well as errors in taxpayer accounts. Consequently, IRS management is impaired in its ability to make well-informed decisions and to accumulate and report financial information in accordance with federal accounting standards. These problems are likely to continue to exist until these software applications are either significantly enhanced or replaced, and IRS remedies the control deficiencies that continue to result in significant errors in taxpayer accounts. IRS’s continuing challenge in addressing its material weakness in internal control over information systems security is primarily due to both continuing and newly identified control deficiencies. As in past years, IRS continued to (1) rely on a procurement system that lacks reliable controls due to access control deficiencies and database maintenance that was not performed; (2) use unencrypted protocols for a sensitive tax processing application; and (3) have unresolved physical security control deficiencies. Further, in fiscal year 2011, we identified control deficiencies in IRS’s (1) system access and configuration controls and (2) controls intended to compensate and mitigate for known information security deficiencies. As a result of these control deficiencies considered collectively, IRS was (1) unable to rely upon its systems or compensating and mitigating controls to provide reasonable assurance that its financial statements were fairly presented, (2) unable to ensure the reliability of other financial management information produced by its systems, and (3) at increased risk of compromising confidential IRS and taxpayer information. In addition to the continuing challenges posed by the two long-standing material weaknesses concerning unpaid assessments and information security, our audit of IRS’s fiscal year 2011 financial statements also identified a continuing significant deficiency in IRS’s internal control over tax refund disbursements, specifically, controls over the processing of claims for the First-time Homebuyer Credit (FTHBC) and over manual refunds. These control deficiencies related to the documentation of FTHBC claims, monitoring of manual refunds, and training of staff having key roles in refund processing. As in past years, IRS continues to face challenges in developing and institutionalizing the use of financial management information to assist it in making operational decisions and in measuring the effectiveness of its programs. IRS made progress during fiscal year 2011 in developing and integrating cost-based performance information into its operational decision-making processes. However, IRS has not yet fully integrated outcome-oriented cost-based performance data into each business units’ routine decision-making processes. IRS has also not yet integrated outcome-oriented performance data into its externally-reported performance metrics. During fiscal year 2011, IRS continued to add to the number of programs and activities for which full cost, and applicable return on investment (ROI), information has been developed.