Internal control is not one event, but a series of actions and activities that occur throughout an entity’s operations and on an ongoing basis. Internal control should be recognized as an integral part of each system that management uses to regulate and guide its operations rather than as a separate system within an agency. In this sense, internal control is management control that is built into the entity as a part of its infrastructure to help managers run the entity and achieve their goals on an ongoing basis. Section 3512 (c), (d) of Title 31, U.S. Code (commonly known as the Federal Managers’ Financial Integrity Act of 1982 (FMFIA)), requires agencies to establish and maintain internal control. The agency head must annually evaluate and report on the control and financial systems that protect the integrity of federal programs. The requirements of FMFIA serve as an umbrella under which other reviews, evaluations, and audits should be coordinated and considered to support management’s assertion about the effectiveness of internal control over operations, financial reporting, and compliance with laws and regulations. Office of Management and Budget (OMB) Circular No. A-123, Management’s Responsibility for Internal Control (revised Dec. 21, 2004), provides the implementing guidance for FMFIA, and sets out the specific requirements for assessing and reporting on internal controls consistent with the internal control standards issued by the Comptroller General of the United States. The circular, which was revised in 2004 with the revisions effective for fiscal year 2006, defines management’s responsibilities related to internal control and the process for assessing internal control effectiveness, and provides specific requirements for conducting management’s assessment of the effectiveness of internal control over financial reporting. The circular requires management to annually provide assurances on internal control in its Performance and Accountability Report, and for the Chief Financial Officers (CFO) Act agencies, beginning in fiscal year 2006, to include a separate assurance on internal control over financial reporting, along with a report on identified material weaknesses and corrective actions. The circular also emphasizes the need for integrated and coordinated internal control assessments that synchronize all internal control-related activities. FMFIA requires GAO to issue standards for internal control in the federal government. GAO’s Standards for Internal Control in the Federal Government provides the overall framework for establishing and maintaining internal control and for identifying and addressing major performance and management challenges and areas at greatest risk of fraud, waste, abuse, and mismanagement. As summarized in GAO’s Standards for Internal Control in the Federal Government, the minimum level of quality acceptable for internal control in the government is defined by the following five standards, which also provide the basis against which internal controls are to be evaluated: Control environment: Management and employees should establish and maintain an environment throughout the organization that sets a positive and supportive attitude toward internal control and conscientious management. Risk assessment: Internal control should provide for an assessment of the risks the agency faces from both external and internal sources. Control activities: Internal control activities help ensure that management’s directives are carried out. The control activities should be effective and efficient in accomplishing the agency’s control objectives. Information and communications: Information should be recorded and communicated to management and others within the entity who need it and in a form and within a time frame that enables them to carry out their internal control and other responsibilities. Monitoring: Internal control monitoring should assess the quality of performance over time and ensure that the findings of audits and other reviews are promptly resolved. The third control standard—internal control activities—helps ensure that management’s directives are carried out. Control activities are the policies, procedures, techniques, and mechanisms that enforce management’s directives. In other words, they are the activities conducted in the everyday course of business that accomplish a control objective, such as ensuring IRS employees successfully complete background checks prior to being granted access to taxpayer information and receipts. As such, control activities are an integral part of an entity’s planning, implementing, reviewing, and accountability for stewardship of government resources and achievement of effective results. A key objective in our annual audits of IRS’s financial statements is to obtain reasonable assurance about whether IRS maintained effective internal controls with respect to financial reporting, including safeguarding of assets, and compliance with laws and regulations. While all five internal control standards are critical and are used by us as a basis for evaluating the effectiveness of IRS’s internal controls, we place a heavy emphasis on testing control activities. This has resulted in the identification of significant deficiencies in certain internal controls over the years and recommendations for corrective action. The objectives of this report are to (1) assist IRS management in tracking the status of financial audit and financial management-related recommendations and the actions needed to address them and (2) demonstrate how the recommendations fit into IRS’s overall management and internal control structure. To accomplish these objectives, we evaluated the effectiveness of IRS’s corrective actions implemented in response to open recommendations during fiscal year 2005 as part of our fiscal years 2005 and 2004 financial audits. To report on the current status of the recommendations, we obtained the status of each recommendation and corrective action taken or planned as of April 2006, as reported to us by IRS. We then compared IRS’s assessment to our fiscal year 2005 audit findings and noted any differences between IRS’s and our conclusions regarding the status of each recommendation. In order to determine how these recommendations fit within IRS’s management and internal control structure, we compared the open recommendations, and the issues that gave rise to them, to the control activities listed in GAO’s Standards for Internal Control in the Federal Government and to the list of major factors and examples outlined in our Internal Control Management and Evaluation Tool. We also considered how the recommendations and the underlying issues were categorized in our prior reports, whether IRS had addressed in whole or in part the underlying control issues that gave rise to the recommendations, and other legal requirements and implementing guidance, such as OMB Circular No. A-123; FMFIA; and the Federal Information System Controls Audit Manual, GAO/AIMD-12.19.6 (revised June 2001). We conducted our review from December 2005 through May 2006 in accordance with U.S. generally accepted government auditing standards. We requested comments on a draft of this report from the Commissioner of Internal Revenue or his designee. We received written comments from the commissioner, which are reprinted in appendix II. IRS continues to make progress on addressing its significant financial management challenges. Over the years since we first began auditing IRS’s financial statements in fiscal year 1992, we have closed out over 200 financial management-related recommendations we made based on actions IRS has taken to improve its internal controls and operational efficiency. This includes 34 recommendations we are closing in fiscal year 2006 based on actions IRS took during the period covered by our fiscal year 2005 financial audit. At the same time, however, our audits continue to identify significant internal control deficiencies, resulting in our making further recommendations for corrective action, including 22 new financial management-related recommendations resulting from our fiscal year 2005 financial audit. These internal control deficiencies, and the resulting recommendations, can directly be traced to the control activities in GAO’s Standards for Internal Control in the Federal Government. As such, it is essential that they be fully addressed and resolved to strengthen IRS’s overall financial management and to assist it in achieving its goals and mission. In April 2005, we issued a report on the status of IRS’s efforts to implement corrective actions to address financial management recommendations stemming from our fiscal year 2004 and prior year financial audits and other financial management-related work. In that report, we identified 84 audit recommendations that at that time, remained open and thus required corrective action by IRS. A significant number of these recommendations had been open for several years, either because IRS had not taken corrective action or because the actions taken had not been effective in resolving the issues that gave rise to the recommendations. IRS continued to work to address many of the internal control deficiencies to which these open recommendations relate. In the course of performing our fiscal year 2005 financial audit, we identified numerous actions IRS took to address many of its internal control deficiencies. Based on IRS’s actions, which we were able to substantiate through our audit, we are able to close 34 of these prior years’ recommendations since we concluded that IRS’s actions effectively addressed the issues that gave rise to them. IRS considers another 23 of the prior years’ recommendations to be effectively addressed. However, we still consider them to be open either because we have not yet had time to verify the effectiveness of IRS’s actions—they occurred subsequent to completion of our audit testing and thus have not been verified, which is a prerequisite to our closing a recommendation—or because the actions taken did not fully address the issue that gave rise to the recommendation. However, continued efforts are needed by IRS to address its serious internal control weaknesses. While we are able to close 34 financial management recommendations made in prior years, this still leaves 50 recommendations from prior years that remain open, a significant number of which have been outstanding for several years. In some cases, as mentioned, IRS may have effectively addressed the issues that gave rise to the recommendations subsequent to our fiscal year 2005 audit testing; however, in many cases, our fiscal year 2005 audit determined that the actions taken to date had not effectively addressed the underlying internal control issues. Additionally, during our fiscal year 2005 audit, we identified additional internal control issues that will require corrective action by IRS. In a recent management report to IRS, we discussed these internal control issues, and made 22 new recommendations to IRS to address these new issues. Consequently, a total of 72 financial management-related recommendations are currently open and need to be addressed by IRS. Of these, we consider 64 to be short term and 8 to be long term.