Internal control is not one event, but a series of actions and activities that occur throughout an entity’s operations and on an ongoing basis. Internal control should be recognized as an integral part of each system that management uses to regulate and guide its operations rather than as a separate system within an agency. In this sense, internal control is management control that is built into the entity as a part of its infrastructure to help managers run the entity and achieve their goals on an ongoing basis. Section 3512 (c), (d) of Title 31, U.S. Code (commonly known as the Federal Managers’ Financial Integrity Act of 1982 (FMFIA)), requires agencies to establish and maintain internal control. The agency head must annually evaluate and report on the control and financial systems that protect the integrity of federal programs. The requirements of FMFIA serve as an umbrella under which other reviews, evaluations, and audits should be coordinated and considered to support management’s assertion about the effectiveness of internal control over operations, financial reporting, and compliance with laws and regulations. Office of Management and Budget (OMB) Circular No. A-123, “Management’s Responsibility for Internal Control” (revised Dec. 21, 2004), provides the implementing guidance for FMFIA, and sets out the specific requirements for assessing and reporting on internal controls consistent with the internal control standards issued by the Comptroller General of the United States. The circular, which was revised in 2004 with the revisions effective for fiscal year 2006, defines management’s responsibilities related to internal control and the process for assessing internal control effectiveness, and provides specific requirements for conducting management’s assessment of the effectiveness of internal control over financial reporting. The circular requires management to annually provide assurances on internal control in its Performance and Accountability Report, and for the 24 Chief Financial Officers (CFO) Act agencies to include a separate assurance on internal control over financial reporting, along with a report on identified material weaknesses and corrective actions. The circular also emphasizes the need for integrated and coordinated internal control assessments that synchronize all internal control-related activities. FMFIA requires GAO to issue standards for internal control in the federal government. GAO’s Standards for Internal Control in the Federal Government provides the overall framework for establishing and maintaining internal control and for identifying and addressing major performance and management challenges and areas at greatest risk of fraud, waste, abuse, and mismanagement. As summarized in GAO’s Standards for Internal Control in the Federal Government, the minimum level of quality acceptable for internal control in the government is defined by the following five standards, which also provide the basis against which internal controls are to be evaluated: Control environment: Management and employees should establish and maintain an environment throughout the organization that sets a positive and supportive attitude toward internal control and conscientious management. Risk assessment: Internal control should provide for an assessment of the risks the agency faces from both external and internal sources. Control activities: Internal control activities help ensure that management’s directives are carried out. The control activities should be effective and efficient in accomplishing the agency’s control objectives. Information and communications: Information should be recorded and communicated to management and others within the entity who need it and in a form and within a time frame that enables them to carry out their internal control and other responsibilities. Monitoring: Internal control monitoring should assess the quality of performance over time and ensure that the findings of audits and other reviews are promptly resolved. The third control standard—internal control activities—helps ensure that management’s directives are carried out. Control activities are the policies, procedures, techniques, and mechanisms that enforce management’s directives. In other words, they are the activities conducted in the everyday course of business that accomplish a control objective, such as ensuring IRS employees successfully complete background checks prior to being granted access to taxpayer information and receipts. As such, control activities are an integral part of an entity’s planning, implementing, reviewing, and accountability for stewardship of government resources and achievement of effective results. A key objective in our annual audits of IRS’s financial statements is to obtain reasonable assurance about whether IRS maintained effective internal controls with respect to financial reporting, including safeguarding of assets, and compliance with laws and regulations. While all five internal control standards are critical and are used by us as a basis for evaluating the effectiveness of IRS’s internal controls, we place a heavy emphasis on testing control activities. This has resulted in the identification of issues in certain internal controls over the years and recommendations for corrective action. To accomplish our objectives, we evaluated the effectiveness of IRS’s corrective actions implemented in response to open recommendations during fiscal year 2006 as part of our fiscal years 2006 and 2005 financial audits. To determine the current status of the recommendations, we (1) obtained the status of each recommendation and corrective action taken or planned as of April 2007, as reported to us by IRS and (2) compared IRS’s assessment to our fiscal year 2006 audit findings to identify any differences between IRS’s and our conclusions regarding the status of each recommendation. In order to determine how these recommendations fit within IRS’s management and internal control structure, we compared the open recommendations, and the issues that gave rise to them, to the control activities listed in GAO’s Standards for Internal Control in the Federal Government and to the list of major factors and examples outlined in our Internal Control Management and Evaluation Tool. We also considered how the recommendations and the underlying issues were categorized in our prior reports, whether IRS had addressed, in whole or in part, the underlying control issues that gave rise to the recommendations, and other legal requirements and implementing guidance, such as OMB Circular No. A-123; FMFIA; and the Federal Information System Controls Audit Manual (FISCAM), GAO/AIMD-12.19.6 (revised June 2001). We conducted our review from December 2006 through April 2007 in accordance with U. S. generally accepted government auditing standards. We requested comments on a draft of this report from the Commissioner of Internal Revenue or his designee on May 7, 2007. We received comments from IRS on May 18, 2007. IRS continues to make progress on addressing its significant financial management challenges. Over the years since we first began auditing IRS’s financial statements in fiscal year 1992, we have closed out over 200 financial management-related recommendations we made based on actions IRS has taken to improve its internal controls and operational efficiency. This includes 25 recommendations we are closing based on actions IRS took during the period covered by our fiscal year 2006 financial audit. At the same time, however, our audits continue to identify internal control issues, resulting in our making further recommendations for corrective action, including 28 new financial management-related recommendations resulting from our fiscal year 2006 financial audit. These internal control issues, and the resulting recommendations, can be directly traced to the control activities in GAO’s Standards for Internal Control in the Federal Government. As such, it is essential that they be fully addressed and resolved to strengthen IRS’s overall financial management and to assist it in achieving its goals and mission. In June 2006, we issued a report on the status of IRS’s efforts to implement corrective actions to address financial management recommendations stemming from our fiscal year 2005 and prior year financial audits and other financial management-related work. In that report, we identified 72 audit recommendations that at that time remained open and thus required corrective action by IRS. A significant number of these recommendations had been open for several years, either because IRS had not taken corrective action or because the actions taken had not fully and effectively resolved the issues that gave rise to the recommendations. IRS continued to work to address many of the internal control issues to which these open recommendations relate. In the course of performing our fiscal year 2006 financial audit, we identified numerous actions IRS took to address many of its internal control issues. On the basis of IRS’s actions, which we were able to substantiate through our audit, we are able to close 25 of these prior years’ recommendations. IRS considers another 26 of the prior years’ recommendations to be effectively addressed. However, we still consider them to be open either because we had not yet been able to verify the effectiveness of IRS’s actions—they occurred subsequent to completion of our audit testing and thus have not been verified, which is a prerequisite to our closing a recommendation—or because the actions taken did not fully address the issue that gave rise to the recommendation. However, continued efforts are needed by IRS to address its internal control issues. While we are able to close 25 financial management recommendations made in prior years, 47 recommendations from prior years remain open, a significant number of which have been outstanding for several years. In some cases, IRS may have effectively addressed the issues that gave rise to the recommendations subsequent to our fiscal year 2006 audit testing. However, in many cases, our fiscal year 2006 audit determined that the actions taken to date had not fully and effectively addressed the underlying internal control issues. Additionally, during our audit of IRS’s fiscal year 2006 financial statements, we identified additional issues that will require corrective action by IRS. In two recent management reports to IRS, we discussed these issues, and made 28 new recommendations to IRS to address these new issues. Consequently, a total of 75 financial management-related recommendations are currently open and need to be addressed by IRS. Of these, we consider 66 short term and 9 long term. Appendix I presents a list of (1) recommendations we have made based on our financial statement audits and other financial management-related work that we had not previously reported as closed prior to our fiscal year 2006 audit, (2) the status of each of these recommendations and corrective actions taken or planned as of April 2007 as reported to us by IRS, and (3) our analysis of whether the issues that gave rise to the recommendations have been effectively and fully addressed based on the work performed during our fiscal year 2006 financial statement audit.