Internal control is not one event, but a series of activities that occur throughout an entity’s operations and on an ongoing basis. Internal control should be an integral part of each system that management uses to regulate and guide its operations rather than as a separate system within an agency. In this sense, internal control is management control that is built into the entity as a part of its infrastructure to help managers run the entity and achieve their goals on an ongoing basis. Section 3512 (c), (d) of Title 31, U.S. Code, commonly known as the Federal Managers’ Financial Integrity Act of 1982 (FMFIA), requires agencies to establish and maintain effective internal control. The agency head must annually evaluate and report on the control and financial systems that protect the integrity of its federal programs. The requirements of FMFIA serve as an umbrella under which other reviews, evaluations, and audits should be coordinated and considered to support management’s assertion about the effectiveness of internal control over operations, financial reporting, and compliance with laws and regulations. Office of Management and Budget (OMB) Circular No. A-123, Management’s Responsibility for Internal Control, provides the implementing guidance for FMFIA, and prescribes the specific requirements for assessing and reporting on internal controls consistent with the Standards for Internal Control in the Federal Government (internal control standards) issued by the Comptroller General of the United States. The circular defines management’s responsibilities related to internal control and the process for assessing internal control effectiveness, and provides specific requirements for conducting management’s assessment of the effectiveness of internal control over financial reporting. The circular requires management to annually provide assurances on internal control and emphasizes the need for integrated and coordinated internal control assessments that synchronize all internal control–related activities. FMFIA requires GAO to issue standards for internal control in the federal government. The internal control standards provide the overall framework for establishing and maintaining effective internal control and for identifying and addressing major performance and management challenges and areas at greatest risk of fraud, waste, abuse, and mismanagement. As summarized in the internal control standards, internal control in the government is defined by the following five elements, which also provide the basis against which internal controls are to be evaluated: Control environment: Management and employees should establish and maintain an environment throughout the organization that sets a positive and supportive attitude toward internal control and conscientious management. Risk assessment: Internal control should provide for an assessment of the risks the agency faces from both external and internal sources. Control activities: Internal control activities help ensure that management’s directives are carried out. The control activities should be effective and efficient in accomplishing the agency’s control objectives. Information and communication: Information should be recorded and communicated to management and others within the entity who need it and in a form and within a time frame that enables them to carry out their internal control and other responsibilities. Monitoring: Internal control monitoring should assess the quality of performance over time and ensure that the findings of audits and other reviews are promptly resolved. A key objective in our annual audits of IRS’s financial statements is to obtain reasonable assurance that IRS maintained effective internal control with respect to financial reporting. While we use all five elements of internal control as a basis for evaluating the effectiveness of IRS’s internal controls, our ongoing evaluations and tests have focused heavily on control activities, where we have identified numerous internal control weaknesses and have provided recommendations for corrective action. Control activities are the policies, procedures, techniques, and mechanisms that enforce management’s directives. In other words, they are the activities conducted in the everyday course of business that are intended to accomplish a control objective, such as ensuring IRS employees successfully complete background checks prior to being granted access to taxpayer information and receipts. Control activities are an integral part of an entity’s planning, implementing, reviewing, and accountability for stewardship of government resources and achievement of effective results. To accomplish our objectives, we evaluated the effectiveness of corrective actions IRS implemented during fiscal year 2010 in response to open recommendations as part of our fiscal years 2010 and 2009 financial audits. To determine the current status of the recommendations, we (1) obtained IRS’s reported status of each recommendation and corrective action taken or planned as of March 2011, (2) compared IRS’s reported status to our fiscal year 2010 audit findings to identify any differences between IRS’s and our conclusions regarding the status of each recommendation, and (3) performed additional follow-up work to assess IRS’s actions taken to address the open recommendations. For our recommendations to IRS regarding information security, this report includes only summary data on the number of those recommendations and their general makeup. Because of the sensitive nature of many of the issues related to our recommendations regarding information security, we have reported our recommendations for corrective action to IRS separately. In order to determine how IRS’s open recommendations, including those identified in our June 2011 management report, fit within the agency’s management and internal control structure, we compared the open recommendations and the issues that gave rise to them to the (1) control activities listed in the internal control standards, (2) list of major factors and examples outlined in our Internal Control Management and Evaluation Tool, and (3) criteria and objectives for federal financial management as discussed in the Chief Financial Officers Act of 1990 Federal Accounting Standards Advisory Board’s (FASAB) Statement of Federal Financial Accounting Concepts No. 1, Objectives of Federal Financial Reporting. We also considered whether IRS had addressed, in whole or in part, the underlying control issues that gave rise to the recommendations; and other legal requirements and implementing guidance, such as OMB Circular No. A-123 and FMFIA. (CFO Act) and the Our work was performed from December 2010 through April 2011 in accordance with generally accepted government auditing standards. IRS continues to make progress in resolving its internal control weaknesses and addressing outstanding recommendations, but it still faces significant financial management challenges. Since we first began auditing IRS’s financial statements in fiscal year 1992, IRS has taken a significant number of actions that enabled us to conclude that it had effectively resolved several material weaknesses and significant deficiencies and to close almost 300 of our previously reported financial management–related recommendations. This includes 37 recommendations we are closing with this report based on actions IRS took through March 2011. Nevertheless, IRS continues to face challenges in improving the effectiveness of its financial and operational management. Specifically, IRS continues to face management challenges in (1) resolving its two material weaknesses and one significant deficiency in internal control, (2) developing performance measures and managing for outcomes, and (3) addressing its remaining internal control issues, particularly those dealing with safeguarding of taxpayer receipts and information. Further, as in previous years’ audits, our fiscal year 2010 audit continued to identify additional internal control issues, resulting in 29 new recommendations for corrective action. These issues are discussed in detail in our June 2011 management report to IRS. In addition, as noted earlier, we also identified numerous issues related to information security during our fiscal year 2010 audit that we reported separately because of the sensitive nature of many of those issues. We have made numerous recommendations to IRS over the years— including new recommendations resulting from our fiscal year 2010 financial audit—to address the issues comprising these weaknesses in internal control. Successfully implementing these recommendations would assist IRS in fully resolving these weaknesses. To its credit, IRS continues to work to address the issues underlying these and other internal control weaknesses. As we reported in our audit of IRS’s fiscal year 2010 financial statements, IRS continues to face significant challenges in resolving its two remaining long-standing material weaknesses in internal control concerning (1) unpaid tax assessments and (2) information security. IRS’s continuing challenge in addressing its material weakness in internal control over unpaid tax assessments results from its (1) inability to use its general ledger and underlying subsidiary records to report federal taxes receivable, compliance assessments, and writeoffs in accordance with federal accounting standards without significant compensating procedures; (2) lack of transaction traceability for the reported balance in taxes receivable that comprises over 80 percent of IRS’s total assets as of September 30, 2010, and an effective transaction-based subledger for unpaid tax assessment transactions; and (3) inability to effectively prevent or timely detect and correct errors in taxpayer accounts. These control deficiencies are caused primarily by IRS’s continued reliance on software applications that were not designed to provide the accurate, complete, and timely transaction-level financial information that management needs to make well-informed decisions or to accumulate and report financial information in accordance with federal accounting standards. These problems are likely to continue to exist until these software applications are either significantly enhanced or replaced. Successfully addressing these issues is vital and is one of the goals of IRS’s ongoing systems-modernization effort. IRS’s continuing challenge in addressing its material weakness in internal control over the management of information systems security is primarily due to IRS not having fully implemented key components of its information security program. Although IRS has processes in place intended to monitor and assess its internal controls, these processes were not always effective. For example, (1) IRS’s testing did not detect many of the vulnerabilities we identified and did not assess a key application in its current environment, and (2) IRS had not effectively validated corrective actions reported to resolve previously identified weaknesses. As we reported in our audit of IRS’s fiscal year 2010 financial statements, IRS has made progress in addressing numerous weaknesses in information security internal control. However, many of the weaknesses we reported in previous years remain unresolved and continue to place IRS systems at risk. For example, IRS (1) continued to allow individuals more access to sensitive information contained on its network than needed to perform their assigned duties, (2) had not completed actions to address a vulnerability in its procurement system that allowed users to enter commands that bypassed normal application security controls, and (3) continued to allow visitors unnecessary access to secured areas at one data center.