The mission of the Internal Revenue Service, a bureau within the Department of the Treasury (Treasury), is to provide America’s taxpayers top quality service by helping them understand and meet their tax responsibilities and by applying the federal tax laws with integrity and fairness to all. In carrying out its mission, IRS annually collects over $2 trillion in taxes from millions of individual taxpayers and numerous other types of taxpayers and manages the distribution of over $300 billion in refunds. To guide its future direction, the agency has two strategic goals: (1) improve taxpayer service to make voluntary compliance easier and (2) enforce the law to ensure everyone meets their obligations to pay taxes. IRS is organized into four primary operating divisions to meet the needs of specific taxpayer segments:  The Wage and Investment Division services individual taxpayers and provides the information, support, and assistance these taxpayers need to fulfill their tax obligations.  The Small Business and Self-Employed Division services all fully or partially self-employed individuals and corporations and partnerships with assets of $10 million or less.  The Large Business and International Division services corporations and partnerships with assets greater than $10 million.  The Tax Exempt and Government Entities Division services a large and unique economic sector of organizations, which include pension plans, exempt organizations, governmental entities, and tax-exempt bond issuers. IRS’s Modernization and InformationTechnology Services (MITS) organization is responsible for delivering IT services and solutions to support tax administration as well as the operations of the broader organization. MITS also supports the delivery of IRS’s business systems modernization efforts and improvement of customer service, and its responsibilities include management of all IT investments in both the development, modernization, and enhancement phase and the operations and maintenance phase. MITS is headed by the Chief Technology Officer. Within MITS, the Strategy and Planning Office, headed by the Associate Chief Information Officer for Strategy and Planning, has primary responsibility for defining and implementing the IT investment management process. The Strategy and Planning office includes a Strategy and Capital Planning (S&CP) group that focuses on IRS-wide IT strategy and capital planning and investment controls. The S&CP office also helps ensure the alignment of IT investments with Treasury’s and IRS’s strategies, as well as with best practices for investment management. It includes the following offices: Investment Planning and Selection Office—responsible for enabling the prioritization and selection of significant IT investments. IT Strategic Planning Office—responsible for determining strategic alignment between the functional areas of the Strategy and Planning office and MITS.  Transition Management Office—responsible for assessing organizational readiness through an examination of people, process, assets, and financials of new, enhanced, and retired systems through procedures and tools and communication with MITS business partners.  Estimation Program Office—responsible for developing and using government and industry best estimation practices in the delivery of full IT life cycle estimates. Investment Management Office—responsible for serving as the primary interface with Treasury’s capital planning and investment control organizations to coordinate actions including baseline change requests, budget formulation documents, and Office of Management and Budget (OMB) IT Dashboard reporting. Investment Evaluation Office—responsible for examining whether an IT investment has met its intended objectives and yielded expected benefits as projected in the business case. The office is also responsible for examining the current performance of an investment and measures the performance against baseline parameters such as cost, schedules, and performance measures, and makes recommendations to IRS senior executives to aid investment management decisions to optimize the IRS IT portfolio. The Strategy and Planning office also includes the Financial Management Services group, which has responsibility for providing guidelines and direction on federal budget and financial policy for IT investments and operations. The group provides guidance on all matters pertaining to budget and financial policy, budget formulation, and financial analysis, including the management of IT expenses across the agency. Figure 1 shows a simplified and partial organizational chart of IRS. IT plays a critical role in enabling IRS to carry out its mission and responsibilities. For example, the agency relies on information systems to process tax returns, account for tax revenues collected, send bills for taxes owed, issue refunds, assist in the selection of tax returns for audit, and provide telecommunications services for all business activities, including the public’s toll-free access to tax information. The President’s fiscal year 2012 budget request for IRS is $13.3 billion. Of this requested amount, about $2.67 billion is for IT investments. According to IRS, about $447 million, or 17 percent, is to be spent on development, modernization, or enhancement activities; $1.88 billion, or 70 percent, is to be spent on operations and maintenance activities; and the remaining $344 million, or 13 percent, is for efforts associated with implementation of the Patient Protection and Affordable Care Act. IRS expects to fund 31 major systems representing about $1.68 billion, or 63 percent, of the total IT request, and 124 nonmajor systems representing $1 billion, or 37 percent, of the total request. Over the years, we have reviewed IRS’s Business Systems Modernization (BSM) program, the agency’s ongoing effort to modernize its tax administration and internal management systems, on an annual basis and also performed other work relevant to investment management at IRS:  Since 1999, we have reviewed and reported on IRS’s Business Systems Modernization program. In particular, we have reported on program management capabilities and controls that are critical to the effective management of this program, such as cost and schedule estimates, requirements development and management, and postimplementation reviews of deployed projects. Accordingly, we have made numerous recommendations aimed at strengthening these controls and capabilities. Most recently, in our May 2010 review of the Business Systems Modernization program, we reported that while IRS had done much to define the phases of its Customer Account Data Engine 2 strategy for managing individual taxpayer accounts, the agency had not defined specific time frames for addressing key planning activities for the second phase, including defining core requirements. We recommended that IRS take several actions to improve program management capabilities and controls, including defining specific time frames for planning activities for the second phase to guide progress. In commenting on a draft of this report, IRS stated it would review the recommendations and provide a detailed corrective action plan to address them.  As part of our annual audit of IRS’s financial statements, we assess the effectiveness of the agency’s information security controls over its key financial and tax processing systems, information, and interconnected networks. In March 2011, we reported that although IRS had made progress in correcting information security weaknesses that we have reported previously, many weaknesses had not been corrected, and we identified many new weaknesses during our audit of its fiscal year 2010 financial statements. Specifically, 65 out of 88 previously reported weaknesses—about 74 percent—had not yet been corrected. In addition, we identified 37 new weaknesses. These weaknesses relate to access controls, configuration management, and segregation of duties. Weaknesses in these areas increase the likelihood of errors in financial data that result in misstatement and expose sensitive information and systems to unauthorized use, disclosure, modification, and loss. An underlying reason for these weaknesses—both old and new—is that IRS has not yet fully implemented key components of a comprehensive information security program. These weaknesses continue to jeopardize the confidentiality, integrity, and availability of the financial and sensitive taxpayer information processed by IRS’s systems and, considered collectively, were the basis of our determination that IRS had a material weakness in internal control over its financial reporting related to information security in fiscal year 2010. In March 2011, we provided an update on IRS’s implementation of its Customer Account Data Engine 2 strategy for managing individual taxpayer accounts, noting weaknesses in the agency’s efforts to improve the credibility of cost estimates and that IRS had not yet finalized expected benefits or set related quantitative targets for the second phase. We recommended that IRS (1) improve the credibility of revised cost estimates by including all costs or provide a rationale for excluding costs, and adjust costs for inflation, and (2) identify all of the second phase benefits, set the related targets, and identify how systems and business process might be affected. IRS agreed with our recommendations. Treasury’s Inspector General for Tax Administration has also recently reported on investment management issues at IRS: In July 2010, the organization reported on IRS’s process to manage and control IT investments. It reported that IRS had recently merged its investment management activities into the Strategy and Capital Planning office, and stated that this office was in the process of updating IRS’s Capital Planning and Investment Control Process Guide, developing desk guides for business cases and data calls, and identifying the steps for implementing a systematic investment selection, monitoring, and review process. It also reported that it concurred with the Strategy and Capital Planning office’s November 2008 self-assessment that IRS was at the ITIM Stage 2 maturity level, and was moving toward the Stage 3 level of developing a complete investment portfolio. In addition to the groups within the MITS Strategy and Planning office mentioned above, several groups and individuals play a role in IRS’s process to manage its IT investments. Involvement from these groups and individuals is necessary to complete aspects of the process including reviewing, approving, and selecting proposed investments; monitoring the investments through their implementation; and evaluating the results once they have become operational. Table 1 identifies the groups that have a role in this process and shows their composition and responsibilities. IRS’s investment management process consists of four phases: preselect, select, control, and evaluate. Each phase is to be completed before beginning the subsequent phase. The preselect phase, which IRS began using during the summer of 2009, is to determine which proposals for new investments can move into the select phase and be considered for inclusion in the IRS IT portfolio. The process is intended to identify the specific business need an investment is expected to address and determine its alignment with the IRS strategic plan.