In 1995, IRS reported collecting $1.4 trillion from taxpayers, disbursing $122 billion in tax refunds, and managing an estimated accounts receivable inventory of $113 billion in delinquent taxes. The reliability of IRS’ financial information is critical to effectively manage the collection of revenue to fund the government’s operations. Our audits of IRS’ financial statements, however, have identified many significant weaknesses in IRS’ accounting for revenue and accounts receivable, as well as for funds provided to carry out IRS’ operations. IRS has improved payroll processing and accounting for administrative operations and is working on solutions to revenue and accounts receivable accounting problems. But much remains to be done, and effective management follow-through is paramount to achieving fully the goals of the CFO Act. In addition, IRS is hampered in efficiently and effectively managing its huge inventory of accounts receivable due to inadequate management information. The root cause here is IRS’ antiquated information systems and outdated business processes, which handle over a billion tax returns and related documents annually. IRS has undertaken many initiatives to deal with its accounts receivable problems, including correcting errors in its tax receivable masterfile and attempting to speed up aspects of the collection process. Efforts such as these appear to have had some impact on collections and the tax debt inventory, but many of the efforts are long-term in nature and demonstrable results may not be available for some time. Further, while IRS’ efforts to reduce filing fraud have resulted in some success—especially through more rigid screening in the electronic filing program—this continues to be a high-risk area. IRS’ goal is to increase electronic filings, which would strengthen its fraud detection capabilities. But to effectively achieve its electronic filing goal, IRS must (1) identify those groups of taxpayers who offer the greatest opportunity for filing electronically and (2) develop strategies focused on alleviating impediments that have inhibited those groups from participating in the program. In attempting to overhaul its timeworn, paper-intensive approach to tax return processing, IRS has spent or obligated over $3 billion on its tax systems modernization, which has encountered severe difficulties. Currently, funding for tax systems modernization has been curtailed, and IRS and the Department of the Treasury are taking several steps to address modernization problems and implement our recommendations. However, much more progress is needed to fully resolve serious underlying management and technical weaknesses. Behind IRS, the Customs Service is the next highest revenue collector. The Customs Service has made considerable progress in correcting major management and organizational structure weaknesses we pointed to in our 1992 high-risk report. In 1995, we reported that Customs had taken several actions to address these problems, including revising its planning process, improving controls over identification and collection of revenues owed, aggressively pursuing delinquent receivables, and embarking on an agencywide reorganization plan. As a result, we narrowed the scope of our high-risk work at Customs to focus only on its financial management problems. Since 1995, Customs has continued to take actions to address its financial management and internal control weaknesses. These include, for example, statistically sampling compliance of commercial importations through ports of entry to better focus enforcement efforts and to project and report duties, taxes, and fees lost due to noncompliance. However, Customs still has not fully corrected significant problems in these areas. For example, audits of Customs’ financial statements under the CFO Act disclose that Customs continues to lack adequate assurance that all revenue due is collected, has weaknesses in readily detecting duplicate and excessive drawback payments, and lacks integrated core financial systems. These problems diminish Customs’ ability to reasonably ensure that (1) duties, taxes, and fees on imports are properly assessed and collected and refunds of such amounts are valid and (2) core financial systems provide reliable information for managing operations. We have made numerous recommendations to Customs to address its financial management weaknesses and have assisted in developing corrective actions. It will be important for top management at Customs to provide continuing support to ensure that the planned financial management improvements are properly implemented. Medicare—the nation’s second largest social program—is inherently vulnerable to and a perpetually attractive target for exploitation. The Congress and the President have been seeking to introduce changes to Medicare to help control program costs, which were $197 billion in fiscal year 1996. At the same time, they are concerned that the Medicare program loses significant amounts due to persistent fraudulent and wasteful claims and abusive billings, which could be from $6 billion to as much as $20 billion, based on 1996 outlays. The Congress passed the Health Insurance Portability and Accountability Act of 1996 to add funding for program safeguard efforts and make the penalties for Medicare fraud more severe. Effective implementation of this legislation and other agency actions are key to mitigating many of Medicare’s vulnerabilities to fraud and abuse. Also, the Health Care Financing Administration (HCFA), which runs the Medicare program, has begun to acquire a new claims processing system—the Medicare Transaction System (MTS)—to provide, among other things, better protection from fraud and abuse. In the past, we have reported on risks associated with this project, including (1) HCFA’s plan to implement the system in a single stage rather than incrementally, (2) difficulty in defining requirements, (3) inadequate investment analysis, and (4) significant schedule problems. HCFA has responded to these concerns by changing its single-stage approach to one under which the system will be implemented incrementally and working to resolve other reported problems. A newly designated high-risk area involves overpayments in the SSI program, which provided about $22 billion in federal benefits to recipients between January 1, 1996, and October 31, 1996. SSI overpayments have grown to over $1 billion per year, which is about 5 percent of total benefit payments. Also, criticisms have been raised regarding the Social Security Administration’s (SSA) ability to effectively manage SSI workloads and internal control weaknesses that leave the program susceptible to fraud, waste, and abuse. For example, in August 1996, we reported that about 3,000 current and former prisoners in 13 county and local jail systems had been erroneously paid $5 million in SSI benefits, primarily because SSA lacked timely and complete information. One root cause of SSI overpayments is SSA’s difficulty in corroborating financial eligibility information that program beneficiaries self report and that affects their benefit levels. In addition, determining whether an impairment qualifies a claimant for disability benefits can often be difficult, especially in cases involving applicants with mental impairments and other hard-to-diagnose conditions. In addition to the difficulties agencies have in managing large computer systems modernization efforts, our high-risk effort identified two governmentwide information technology issues that affect agencies under the Committee’s purview: information security and the Year 2000 Problem. Information systems security weaknesses pose high risk of unauthorized access and disclosure of sensitive data. Many federal operations that rely on computer networks are attractive targets for individuals or organizations with malicious intentions. Examples of such operations include law enforcement, import entry processing, and various financial transactions. Since June 1993, we have issued over 30 reports describing serious information security weaknesses at major federal agencies. For example, our financial audits at IRS and the Customs Service have identified poor computer controls. IRS cannot ensure that the confidentiality and accuracy of taxpayer data are protected and that the data are not manipulated for purposes of individual gain. The Customs Service continues to have problems that diminish its ability to reasonably ensure that sensitive data maintained in automated systems are adequately protected from unauthorized access and modification. In September 1996, we reported that during the previous 2 years, serious information security control weaknesses had been reported for 10 of the 15 largest federal agencies. We have made dozens of recommendations for improvement to individual agencies, and they have started acting on many of them. In addition, we have recommended ways for the Office of Management and Budget (OMB) to enhance its ability to oversee and improve federal information security programs. We suggested steps that OMB can take to (1) effectively use opportunities to aid in overseeing and improving agency information security programs, such as annual financial audits and the newly created Chief Information Officers Council,and (2) increase the expertise of its staff in information security management issues. The Year 2000 Problem poses the high risk that computer systems throughout government will fail to run or malfunction because computer equipment and software were not designed to accommodate the change of date at the new millennium. For example, IRS’ tax systems could be unable to process returns, which in turn could jeopardize the collection of revenue and the entire tax processing system. Or SSA’s disability insurance process could experience major disruptions if the interface with various state systems failed, thereby causing delays and interruptions in disability payments to citizens. We recently issued a guide, Year 2000 Computing Crisis: An Assessment Guide (GAO/AIMD-10.1.14, exposure draft), to provide agencies a framework and a checklist for assessing their readiness to achieve year 2000 compliance. It provides information on the scope of the challenge, and offers a structured approach for reviewing the adequacy of agency planning and management of the year 2000 program. Continued congressional oversight, such as this hearing by the Subcommittee, will add essential impetus to make improvements and ensure more progress in addressing the high-risk areas just discussed and, thus, to achieve greater benefits. Effective and sustained follow-through by agency managers is necessary to resolve specific high-risk problems and implement broader management reforms, which the Congress has established to achieve better financial and information management and measure the results of program operations. The Subcommittee can focus on agencies’ progress in fixing specific high-risk problems and implementing this legislative framework through the following three efforts. Apply a framework of modern technology management, as required by the 1995 Paperwork Reduction Act and the Clinger-Cohen Act of 1996. This framework is based on practices followed by leading public-sector and private-sector organizations that have successfully used technology to dramatically improve performance and meet strategic goals.