This section discusses significant matters that we considered in performing our audit and in forming our conclusions. These matters include (1) six material weaknesses in IRS’ internal controls, (2) one reportable condition representing a significant weakness in IRS’ internal controls, (3) one instance of noncompliance with laws and regulations and noncompliance with the requirements of FFMIA, and (4) two other significant matters that represent important issues that should be brought to the attention of IRS management and other users of IRS’ Custodial Financial Statements and other reported financial information. During our audit of IRS’ fiscal year 1997 Custodial Financial Statements, we identified six material weaknesses that adversely affected IRS’ ability to safeguard assets from material loss, assure material compliance with relevant laws and regulations, and assure that there were no material misstatements in the financial statements. These weaknesses relate to IRS’ inadequate general ledger system, supporting subsidiary ledger for unpaid assessments, supporting documentation for unpaid assessments, controls over refunds, revenue accounting and reporting, and computer security. These material weaknesses were consistent in all significant respects with the material weaknesses cited by IRS in its fiscal year 1997 FIA report. Although we were able to apply substantive audit procedures to verify that IRS’ fiscal year 1997 Custodial Financial Statements were reliable, the six material weaknesses discussed in the following sections significantly increase the risk that future financial statements and other IRS reports may be materially misstated. The IRS’ general ledger system is not able to routinely generate reliable and timely financial information for internal and external users. The IRS’ general ledger does not capture or otherwise produce the information to be reported in the Statement of Custodial Assets and Liabilities; classify revenue receipts activity by type of tax at the detail transaction level to support IRS’ Statement of Custodial Activity and to make possible the accurate distribution of excise tax collections to the appropriate trust funds; use the standard federal accounting classification structure to produce some of the basic documents needed for the preparation of financial statements in the required formats, such as trial balances; and provide a complete audit trail for recorded transactions. As a result of these deficiencies, IRS is unable to rely on its general ledger to support its financial statements, which is a core purpose of a general ledger. These problems also prevent IRS from producing financial statements on a monthly or quarterly basis as a management tool, which is standard practice in private industry and some federal entities. The U.S. Government Standard General Ledger (SGL) establishes the general ledger account structure for federal agencies as well as the rules for agencies to follow in recording financial events. Implementation of the SGL is called for by the Core Financial System Requirements of the Joint Financial Management Improvement Program (JFMIP), and is required by the Office of Management and Budget (OMB) in its Circular A-127, Financial Management Systems. Implementation of financial management systems that comply with the SGL at the transaction level is also required by FFMIA. However, because of the problems discussed above, IRS’ general ledger does not comply with these requirements. As we previously reported, IRS’ general ledger was not designed to support financial statement preparation. To compensate for this deficiency, IRS utilizes specialized computer programs to extract information from its master files—its only detailed database of taxpayer information—to derive amounts to be reported in the financial statements. However, the amounts produced by this approach needed material audit adjustments to the Statement of Custodial Assets and Liabilities to produce reliable financial statements. Although we were able to verify that the adjusted balances were reliable as of and for the fiscal year ended September 30, 1997, this approach cannot substitute for a properly designed and implemented general ledger as a tool to account for and report financial transactions on a routine basis throughout the year. As we have reported in our previous financial audits, IRS does not have a detailed listing, or subsidiary ledger, which tracks and accumulates unpaid assessments on an ongoing basis. To compensate for the lack of a subsidiary ledger, IRS runs computer programs against its master files to identify and classify the universe of unpaid assessments. However, this approach required numerous audit adjustments to produce reliable balances. The lack of a detailed subsidiary ledger impairs IRS’ ability to effectively manage the unpaid assessments. For example, IRS’ current systems precluded it from ensuring that all parties liable for certain assessments get credit for payments made on those assessments. Specifically, payments made on unpaid payroll tax withholdings for a troubled company, which can be collectible from multiple individuals, are not always credited to each responsible party to reflect the reduction in their tax liability. In 53 of 83 cases we reviewed involving multiple individuals and companies, we found that payments were not accurately recorded to reflect the reduction in the tax liability of each responsible party. In one case we reviewed, three individuals had multimillion dollar tax liability balances, as well as liens placed against their property, even though the tax had been fully paid by the company. While we were able to determine that the amounts reported in the fiscal year 1997 financial statements pertaining to taxes receivable, a component of unpaid assessments, were reliable, this was only after significant adjustments totaling tens of billions of dollars were made. The extensive reliance IRS must place on ad hoc procedures significantly increases the risk of material misstatement of unpaid assessments and/or other reports issued by IRS in the future. A proper subsidiary ledger for unpaid assessments, as recommended by the JFMIP Core Financial Systems Requirements, is necessary to provide management with complete, up-to-date information about the unpaid assessments due from each taxpayer, so that managers will be in a position to make informed decisions about collection efforts and collectibility estimates. This requires a subsidiary ledger that makes readily available to management the amount, nature, and age of all unpaid assessments outstanding by tax liability and taxpayer, and that can be readily and routinely reconciled to corresponding general ledger balances for financial reporting purposes. Such a system should also track and make available key information necessary to assess collectibility, such as account status, payment and default history, and installment agreement terms. In our audit of IRS’ fiscal year 1996 Custodial Financial Statements, we reported that IRS could not locate sufficient supporting documentation to (1) enable us to evaluate the existence and classification of unpaid assessments or (2) support its classification of reported revenue collections and refunds paid. During our fiscal year 1997 audit, IRS was able to locate and provide sufficient supporting documentation for fiscal year 1997 revenue and refund transactions we tested. However, IRS continued to experience significant problems locating and providing supporting documentation for unpaid assessments, primarily due to the age of the items. Documentation for transactions we reviewed, such as tax returns or installment agreements, had often been destroyed in accordance with IRS record retention policies or could not be located. In addition, the documentation IRS provided did not always include useful information, such as appraisals, asset searches, and financial statements. For example, estate case files we reviewed generally did not include audited financial statements or an independent appraisal of the estate’s assets, information that would greatly assist in determining the potential collectibility and potential underreporting of these cases. Additionally, the lack of documentation made it difficult to assess the classification and collectibility of unpaid assessments reported in the financial statements as federal tax receivables. Through our audit procedures, we were able to verify the existence and proper classification of unpaid assessments and obtain reasonable assurance that reported balances were reliable. However, this required material audit adjustments to correct misstated unpaid assessment balances identified by our testing. IRS did not have sufficient preventive controls over refunds to assure that inappropriate payments for tax refunds are not disbursed. Such inappropriate payments have taken the form of refunds improperly issued or inflated, which IRS did not identify because of flawed verification procedures, or fraud by IRS employees. For example, we found three instances where refunds were paid for inappropriate amounts. This occurred because IRS does not compare tax returns to the attached W-2s (Wage and Tax Statements) at the time the returns are initially processed, and consequently did not detect a discrepancy with pertinent information on the tax return. As we have reported in prior audits, such inconsistencies generally go undetected until such time as IRS completes its document matching program, which can take as long as 18 months. In addition, during fiscal year 1997, IRS identified alleged employee embezzlement of refunds totaling over $269,000. IRS is also vulnerable to issuance of duplicate refunds made possible by gaps in IRS’ controls. IRS reported this condition as a material weakness in its fiscal year 1997 FIA report. The control weaknesses over refunds are magnified by significant levels of invalid Earned Income Credit (EIC) claims. IRS recently reported that during the period January 1995 through April 1995, an estimated $4.4 billion (25 percent) in EIC claims filed were invalid. This estimate does not reflect actual disbursements made for refunds involving EIC claims. However, it provides an indication of the magnitude of IRS’ and the federal government’s exposure to losses resulting from weak controls over refunds. While we were able to substantiate the amounts disbursed as refunds as reported on the fiscal year 1997 Custodial Financial Statements, IRS needs to have effective preventive controls in place to ensure that the federal government does not incur losses due to payment of inappropriate refunds. Once an inappropriate refund has been disbursed, IRS is compelled to expend both the time and expense to attempt to recover it, with dubious prospect of success. IRS is unable to currently determine the specific amount of revenue it actually collected for the Social Security, Hospital Insurance, Highway, and other relevant trust funds. As we previously reported, the primary reason for this weakness is that the accounting information needed to validate the taxpayer’s liability and record the payment to the proper trust fund is not provided at the time that taxpayers remit payments.