This is the accessible text file for GAO report number GAO-07-692R 
entitled 'Management Report: IRS's First-Year Implementation of the 
Requirements of the Office of Management and Budget's (OMB) Revised 
Circular No. A-123' which was released on May 18, 2007. 

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as part 
of a longer term project to improve GAO products' accessibility. Every 
attempt has been made to maintain the structural and data integrity of 
the original printed product. Accessibility features, such as text 
descriptions of tables, consecutively numbered footnotes placed at the 
end of the file, and the text of agency comment letters, are provided 
but may not exactly duplicate the presentation or format of the printed 
version. The portable document format (PDF) file is an exact electronic 
replica of the printed version. We welcome your feedback. Please E-mail 
your comments regarding the contents or accessibility features of this 
document to Webmaster@gao.gov. 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

May 18, 2007: 

The Honorable Mark W. Everson: 

Commissioner of Internal Revenue: 

Subject: Management Report: IRS's First-Year Implementation of the 
Requirements of the Office of Management and Budget's (OMB) Revised 
Circular No. A-123: 

Dear Mr. Everson: 

This letter summarizes our review of the Internal Revenue Service's 
(IRS) implementation of the requirements of the Office of Management 
and Budget's (OMB) revised Circular No. A-123, Management's 
Responsibility for Internal Control (A-123) during fiscal year 2006. 
These requirements are applicable to the 24 Chief Financial Officer 
(CFO) Act agencies, including the Department of the Treasury 
(Treasury), of which IRS is a significant component. The objectives of 
our review, which was conducted as part of our audit of IRS's fiscal 
year 2006 financial statements,[Footnote 1] were to determine whether 
(1) IRS appropriately planned and implemented its assessment of 
internal controls over financial reporting in accordance with the 
requirements of OMB Circular No. A-123, (2) IRS performed sufficient 
work to support its related assurance statement to Treasury, and (3) 
IRS's assurance statement appropriately represented the status of IRS's 
internal control over financial reporting. 

We performed our work from January through October 2006 as part of our 
audits of IRS's fiscal years 2006 and 2005 financial statements. We 
conducted our work in accordance with U.S. generally accepted 
government auditing standards. 

Results in Brief: 

IRS appropriately planned and implemented its first-year assessment of 
internal controls over financial reporting in accordance with the 
requirements of OMB Circular No. A-123 sufficient to support its 
assurance statement to Treasury as of June 30, 2006. Overall, we were 
impressed by IRS's commitment to the successful implementation of OMB 
Circular No. A-123, and its diligent efforts to effectively execute the 
circular's requirements. IRS's approach was indicative of management's 
recognition of its responsibility for the integrity of the 
organization's internal control structure and its desire to make the 
most of this process and effectively resolve its internal control 
issues. However, full implementation of the requirements of the revised 
OMB Circular No. A-123 at an agency as large and complex as IRS is a 
major undertaking that will require a significant commitment of 
resources and several years to achieve. 

As we noted in our report on our audit of IRS's fiscal year 2006 
financial statements and communicated to IRS during the course of our 
audit, we identified several areas where IRS could enhance its A-123 
review process. Specifically, we found that IRS did not always clearly 
document procedures performed or how test results were linked to the 
resultant conclusions. In addition, although IRS was aware of the 
findings of audits performed by GAO and the Treasury Inspector General 
for Tax Administration (TIGTA), we did not always find documentation 
that these findings were consistently utilized by IRS in planning its A-
123 reviews. We also did not find documentation that in planning its A-
123 review, IRS appropriately considered the most recent audit of the 
Department of Agriculture's National Finance Center, which processes 
IRS's payroll transactions, or the extent to which its own information 
security work conducted in accordance with the Federal Information 
Security Management Act of 2002 (FISMA),[Footnote 2] met the objectives 
of OMB Circular No. A-123. Identifying existing reviews and audits 
related to internal controls over financial reporting, determining the 
extent to which these efforts can be used to complement the A-123 work, 
and assessing how that use might affect the scope and nature of 
procedures to be performed are an important part of the related 
planning process. Clearly documenting procedures conducted and 
consideration of existing reviews and audits reduces the risk that IRS 
may provide a degree of assurance on the effectiveness of its control 
over financial reporting that is not warranted by existing conditions. 

We also found that while the scope and nature of A-123 procedures 
performed by IRS during fiscal year 2006 were appropriate in the 
circumstances, as IRS's A-123 process moves to the next stage, 
additional work will be required. We found that (1) the tests IRS 
conducted focused on the execution of controls over individual 
transaction types, and have not yet effectively addressed the design of 
controls; (2) IRS has not yet tested controls over compliance with all 
significant financial-reporting-related laws and regulations; and (3) 
information security work IRS conducted under FISMA did not identify 
many of the vulnerabilities we identified during our testing of its 
information security as part of our fiscal year 2006 financial audit. 
Consequently, IRS's A-123 process was not at a point where it would 
have identified all of IRS's existing control deficiencies nor been 
sufficient to support an unqualified statement of assurance as of June 
30, 2006, had that been appropriate in the circumstances. Also, once 
IRS is in a position to support an unqualified assurance statement, it 
will become necessary for it to conduct follow-up procedures during the 
last 3 months of the year subsequent to the June 30 A-123 reporting 
date to support an unqualified assurance statement as of September 30 
to correspond with the date of our opinion on the effectiveness of 
IRS's internal controls. 

Because IRS had four material weaknesses in its internal controls in 
fiscal year 2006, the additional procedures that would be needed to 
support unqualified assurance were not necessary. However, IRS is 
working diligently to resolve its material weaknesses. As these issues 
are resolved, the scope and nature of procedures IRS will need to 
perform will gradually increase. As IRS continues to enhance its A-123 
effort, it will need to consider these issues and take appropriate 
steps to address them in order to position it to support statements of 
unqualified assurance as of June 30 and September 30 as will become 
appropriate at such time as IRS fully resolves its material weaknesses. 

This report contains seven recommendations intended to assist IRS in 
strengthening its A-123 process as it continues to mature, so that once 
the process is fully developed, IRS will be able to rely on it to 
identify any existing material weaknesses or other significant control 
deficiencies. In so doing, IRS will also position itself so that once 
its existing material internal control weaknesses are resolved, it will 
be able to rely on its A-123 process to support appropriate unqualified 
statements of assurance as of June 30 and September 30. 

In its comments, IRS agreed with our recommendations and described 
actions it had taken or plans to take to address the issues we raised 
in this report. At the end of our recommendations for executive action, 
we have summarized IRS's related comments and provided our evaluation. 

Scope and Methodology: 

In conducting our review of IRS's implementation of OMB Circular No. A- 
123, we reviewed documentation and conducted discussions with IRS and 
Treasury officials concerning how the A-123 process was planned, 
implemented, summarized, and reported. Specifically, we reviewed and 
discussed the following: 

 Treasury's and IRS's strategy and overall plans for implementing OMB 
Circular No. A-123 at IRS, including (1) how the process was to be 
organized, staffed, supervised, and conducted, and (2) how the results 
were to be summarized and reported, and appropriate corrective action 
plans developed and implemented; 

 Treasury's and IRS's selection of transaction processes considered 
material to IRS; 

 IRS's workpapers supporting its tests of controls over the 12 of the 
45 transaction processes that we considered to be the most material to 
IRS's financial statements, including internal controls over tax 
revenue, tax refunds, taxes receivable, expenses, and budgetary 
transactions; 

 IRS's evaluation of entitywide controls, such as the overall control 
environment, integrity and ethical values, information and 
communications, and monitoring; and: 

 IRS's A-123 assurance statement to Treasury and its relationship to 
the underlying work and results. 

We also observed IRS's tests of internal controls over (1) tax revenue 
at one service center campus and one Taxpayer Assistance Center, and 
(2) tax refunds at one service center campus. Additional details on our 
scope and methodology are included in our fiscal year 2006 financial 
statement audit report. 

Background: 

The passage of the Sarbanes-Oxley Act of 2002 (SOX)[Footnote 3] served 
as an impetus for the federal government to review its existing 
internal control requirements.[Footnote 4] SOX requires that management 
of publicly traded companies strengthen their processes for assessing 
and reporting on their internal control over financial reporting. 
Consistent with the intent of SOX, the joint Chief Financial Officers 
Council (CFOC)[Footnote 5] and President's Council on Integrity and 
Efficiency (PCIE)[Footnote 6] committee recommended that OMB Circular 
No. A-123 be strengthened to require a more rigorous assessment of 
federal agencies' internal control over financial reporting. OMB 
accepted this recommendation and worked with the CFOC/PCIE working 
group to significantly revise its Circular No. A-123. 

OMB's revised Circular No. A-123, along with its related implementation 
guide,[Footnote 7] were effective for fiscal year 2006. OMB Circular 
No. A-123 provides specific requirements for the 24 major departments 
and agencies covered under the Chief Financial Officers Act of 1990 
(CFO Act)[Footnote 8] to follow in conducting management's assessment 
of the effectiveness of internal control over financial reporting. The 
assessment process requires (1) understanding the control environment 
including the financial reporting process, (2) understanding the design 
of internal controls, (3) identifying and evaluating significant 
classes of transactions and assessing risks, and (4) testing controls 
to assess compliance. Based on the results of the assessment process, 
each CFO Act agency is required to prepare a statement asserting the 
effectiveness of its internal control over financial reporting as of 
June 30 of each fiscal year, which is to be included in the agency's 
Performance and Accountability Report (PAR). 

IRS does not produce its own PAR. As a bureau of Treasury, however, 
IRS's assurance statement is used by Treasury as a basis for its own 
assurance statement, which is included in the department's PAR. The 
assurance provided in this statement can take one of three forms: (1) 
unqualified assurance, indicating that no material weaknesses were 
found, (2) qualified assurance, indicating that one or more material 
weaknesses were identified, or (3) a statement of no assurance, 
indicating that no internal control process was in place or that 
pervasive material weaknesses were found. Based on their A-123 
assessment, agencies are required to develop an appropriate corrective 
action plan to address any control deficiencies identified. OMB 
Circular No. A-123 requires that agencies document their control over 
financial reporting and the related assessment process, including key 
decisions, the assessment methodology and its implementation, the 
testing of controls and related results, and any corrective action 
plan. 

In fiscal year 2006, Treasury established the framework for the 
implementation of the revised OMB Circular No. A-123 for all of its 
bureaus, including IRS. This included establishing an overall 
departmentwide implementation plan, identifying and documenting 
controls significant to Treasury and assessing related risks, and 
establishing milestones for implementation and completion of the A-123 
process. Treasury also established a threshold to determine which of 
the bureaus' transactions were considered material to the department's 
consolidated financial statements.[Footnote 9] Based on this threshold, 
Treasury required its bureaus to test controls over certain specific 
financial transactions. 

Within this overall framework, IRS established a management structure 
under the direction of the CFO to organize and oversee IRS's 
implementation of OMB Circular No. A-123. Major elements of IRS's A-123 
process included: 

* developing an IRS's specific implementation guide for the 
implementation of OMB Circular No. A-123; 

* identifying transaction processes considered material to IRS that had 
not been identified by Treasury; 

* planning and conducting tests of controls over 45 transaction 
processes considered material to Treasury or IRS; 

* reviewing the effectiveness of entitywide controls, including the 
overall control environment, integrity and ethical values, information 
and communications, and monitoring; and: 

* reviewing compliance with certain laws and regulations pertinent to 
financial reporting and internal control, including the Federal 
Financial Management Improvement Act of 1996 (FFMIA);[Footnote 10] 31 
U.S.C.  3512(c), (d), commonly referred to as the Financial Managers' 
Financial Integrity Act of 1982 (FIA); the CFO Act; and FISMA. 

Based on the results of these procedures and considering the material 
weaknesses reported by us in our previous audit of IRS's financial 
statements,[Footnote 11] IRS provided Treasury qualified assurance that 
its controls over financial reporting were effective as of June 30, 
2006. 

IRS Successfully Implemented the Revised OMB Circular No. A-123 in 
Fiscal Year 2006: 

IRS appropriately planned and implemented its assessments of internal 
controls over financial reporting in accordance with the requirements 
of OMB Circular No. A-123 sufficient to support its assurance statement 
to Treasury as of June 30, 2006. We also noted that IRS elected to 
implement this process using its own staff rather than contractors, 
thereby taking advantage of the opportunity for IRS staff and 
management to gain a better understanding of the intricacies of, and 
issues associated with, the agency's complex internal control 
structure. This, in turn, better positioned management and staff to 
benefit from the lessons learned through this first year of 
implementation. This approach was indicative of management's 
recognition of its responsibility for the integrity of the 
organization's internal control structure and its desire to make the 
most of this process and effectively resolve its internal control 
issues. 

We also found that we were able to use some of the procedures performed 
by IRS, such as its tests of entitywide controls and compliance with 
the statutory requirement regarding the timing of tax lien releases, to 
supplement or reduce the scope of our internal control testing 
conducted as part of our audit of IRS's fiscal years' 2006 and 2005 
financial statements. 

Full implementation of the requirements of the revised OMB Circular No. 
A-123 at an agency as large and complex as IRS is a major undertaking 
that will require a significant commitment of resources and several 
years to achieve. Additionally, due to the presence of four material 
weaknesses in internal controls as of September 30, 2005,[Footnote 12] 
the scope and nature of the A-123 work IRS needed to perform in fiscal 
year 2006 was significantly less than would have been necessary had 
these reported weaknesses not existed. In this context, we found that 
(1) IRS appropriately planned and implemented its assessment of 
internal controls in accordance with the requirements of OMB Circular 
No. A-123, (2) IRS performed sufficient work to support its related 
assurance statement to Treasury, and (3) IRS's assurance statement 
appropriately represented the status of IRS's internal control over 
financial reporting. 

Opportunities for IRS to Enhance the A-123 Process: 

While we found that IRS's first-year implementation of the revised OMB 
Circular No. A-123 enabled it to fully support its June 30, 2006, 
assurance statement, our review identified several opportunities to 
enhance the process to better ensure that future reviews will fully 
address the requirements of the revised OMB Circular No. A-123 as IRS's 
implementation process continues to develop. Specifically, we 
identified opportunities with respect to (1) the documentation of 
completed test procedures and (2) the scope and nature of test 
procedures conducted. 

Documentation of Test Procedures Conducted: 

We found that the conclusions IRS reached concerning the effectiveness 
of its controls were appropriate. Nevertheless, IRS's documentation of 
the results of certain specific transaction tests did not always 
clearly indicate what internal control test procedures were performed 
or how conclusions were reached. For example, IRS's summary of work on 
its tests of invoice or voucher payment and approval noted that there 
were no errors found, and concluded that controls were effective. 
However, the summary also noted that IRS personnel found 3 errors in 
testing 45 sample items, which appeared to indicate that controls were 
not effective.[Footnote 13] Based on discussions with IRS staff, we 
determined that although it was not apparent from the documentation in 
the workpapers, the 3 errors noted were actually not related to the 
control attributes being tested and hence, did not affect the 
conclusion. However, such ambiguity and lack of clarity in test 
documentation and its relationship to the related conclusions increases 
the risk that conclusions may not reflect actual existing control 
conditions. 

As provided for in OMB Circular No. A-123, and in accordance with the 
overall approach defined by Treasury, IRS used the results of existing 
audits and reviews to supplement its testing. We found that, in its 
remediation plans prepared in accordance with FIA, IRS considered the 
findings of the audits of GAO and TIGTA. Also, we noted that several of 
IRS's A-123 test plans incorporated procedures for consideration of 
prior audits and reviews relevant to the controls being tested. 
However, IRS did not always document how it considered these audits and 
reviews in determining the nature, scope, and timing of procedures it 
planned to conduct under OMB Circular No. A-123. For example, the IRS 
planning documents and workpapers did not always document how it 
considered the results of the following audits and reviews in 
formulating the nature, scope, and timing of its test procedures: (1) 
GAO audits, such as our prior audits of IRS's financial statements, (2) 
TIGTA audits or reviews that may have been relevant to IRS's internal 
control over financial reporting, or (3) its own information security 
work conducted under FISMA. We also did not see documentation of IRS's 
consideration of the results of the most recent audit of the controls 
over the Department of Agriculture's National Finance Center, which IRS 
relies on to process its payroll transactions. By consistently 
documenting how it considered these prior audits and reviews, IRS would 
reduce the risk that it may (1) not appropriately consider issues 
significant to IRS's internal control over financial reporting, (2) 
place undue reliance on reviews whose scope and methodology is not well 
suited to the objectives set out in OMB Circular No. A-123, or (3) 
perform unnecessary duplicative work. 

Scope and Nature of Test Procedures Conducted: 

As noted above, the procedures conducted by IRS were adequate to 
support the qualified assurance it provided as of June 30, 2006. 
However, as IRS moves to an unqualified opinion on its internal control 
in the future, its procedures will need to further evolve. 

IRS's control testing approach was not yet at the stage that it fully 
considered the design of control over financial reporting. Rather, the 
approach was largely transaction based. Consequently, IRS's tests would 
not likely have identified some of the significant systemic control 
design deficiencies that we have reported in our audits of IRS's 
financial statements, including IRS's lack of (1) a subsidiary ledger 
for taxes receivable, (2) cost accounting capabilities necessary to 
readily determine the costs of its activities and programs in multiple 
business units, or (3) a U.S. Standard General Ledger-compliant general 
ledger for its tax-related transactions. Because IRS had not yet fully 
considered the design of internal control over financial reporting, the 
risk is increased that in the absence of our annual audit of IRS's 
financial statements, it may not identify all deficiencies in the 
design of its related controls. 

As noted above, IRS reviewed compliance with FFMIA, FIA, the CFO Act, 
and FISMA. IRS also tested compliance with the legal requirement that 
liens on taxpayer property be released within 30 days of the 
satisfaction of the debt.[Footnote 14] However, IRS had not yet tested 
controls over compliance with other significant financial-related laws 
and regulations. For example, its testing did not address controls over 
compliance with the Anti-Deficiency Act, as amended[Footnote 15] or the 
Prompt Payment Act.[Footnote 16] OMB Circular No. A-123 defines the 
scope of assessing and documenting internal control over financial 
reporting to include compliance with laws and regulations. However, 
since IRS did not test controls over compliance with several laws and 
regulations significant to financial reporting, its management could 
not have provided unqualified assurance regarding the design and 
operating effectiveness of controls in this area, had that been 
warranted. 

IRS's use of work it performed under FISMA to meet the requirements of 
OMB Circular No. A-123 as it relates to information technology security 
controls was permitted by A-123 and was in accordance with Treasury's 
overall approach. Such use requires that the work be conducted in a 
manner sufficient to meet the requirements of OMB Circular No. A-123, 
as well as FISMA. However, we did not see evidence that IRS assessed 
whether the work being conducted under FISMA was sufficient to meet the 
objectives set out in OMB Circular No. A-123, for which the FISMA work 
was not originally designed. Our review of IRS's information security 
conducted as part of our fiscal year 2006 financial audit found 
weaknesses indicating that IRS's FISMA work was not always sufficient 
to meet the related objectives of the OMB circular. For example, as 
part of IRS's FISMA work, it tested and evaluated security controls for 
each of the automated systems we reviewed as part of our fiscal year 
2006 financial audit.[Footnote 17] However, we found that IRS's FISMA 
testing did not address many of the vulnerabilities we reported based 
on our work. For example, IRS's test and evaluation plan for its 
procurement system did not include tests for password expiration, 
insecure protocols, or removal of employees' system access after 
separation from the agency. Consequently, the information security work 
IRS conducted in accordance with FISMA did not identify many of the 
vulnerabilities we identified during our audit of IRS's fiscal year 
2006 financial statements, nor assess the risks associated with those 
vulnerabilities. This increases the risk that IRS's information 
security work conducted to comply with FISMA may not satisfy the 
related objectives set out in OMB Circular No. A-123. 

IRS did not perform procedures under OMB Circular No. A-123 during the 
last 3 months of fiscal year 2006 to verify that the state of its 
internal controls had not significantly changed since the date of its 
assurance statement, which was June 30. OMB Circular No. A-123 does not 
require such procedures, but does permit agencies to adjust the "as of" 
date of their assurance statement if the agency is receiving a separate 
audit opinion on its internal controls as of September 30. Given the 
four material weaknesses in IRS's internal control that we had 
identified during our audit of IRS's financial statements,[Footnote 18] 
not testing internal control during the fourth quarter did not affect 
IRS's assurance statement for internal controls as of September 30, 
2006.[Footnote 19] In future years, at such time as IRS has effectively 
resolved its existing material internal control deficiencies, follow-up 
procedures to test controls during the last 3 months of the fiscal year 
will become necessary in order for IRS to assert that its internal 
controls are effective as of September 30. 

As noted above, fiscal year 2006 was the first year IRS implemented the 
requirements of the revised OMB Circular No. A-123, and this process 
will likely take several more years to fully mature. As the process 
continues to develop, IRS will need to overcome a number of significant 
challenges, such as balancing the significant resource needs of this 
process with the ongoing demands of its daily operations. In addition, 
many of the related tasks, such as documenting internal controls, 
assessing related risks, evaluating the design of controls, conducting 
appropriate tests of the operating effectiveness of controls, 
evaluating and reporting the results of these tests, and appropriately 
documenting these internal control procedures, are skills typically 
associated with financial auditors. Implementing OMB Circular No. A-123 
has required IRS's staff to assume responsibilities for which their 
prior training and operational experience had typically not prepared 
them. As it continues to implement OMB Circular No. A-123, IRS will 
need to successfully meet these challenges in order to minimize the 
risk that, in the absence of our annual financial audit, significant 
deficiencies in internal controls might exist and not be identified in 
this process. Should this occur, IRS might provide a level of assurance 
on the effectiveness of its internal controls not warranted by existing 
conditions. 

Conclusion: 

IRS did a commendable job in its first-year implementation of the 
requirements of the revised OMB Circular No. A-123. IRS's decision to 
rely on its own staff to conduct this work, while presenting challenges 
in the short term, also has the potential to pay significant dividends 
in the future in terms of IRS's ability to make effective use of its A- 
123 findings to improve operations. As IRS moves forward, it should 
work to enhance the documentation of the procedures it performs. In 
addition, while IRS's A-123 process in fiscal year 2006 was adequate to 
support its June 30, 2006, assurance statement to Treasury, it is 
important to recognize that additional work will be needed to provide 
the unqualified assurance statement that will become appropriate once 
IRS has addressed the long-standing material weaknesses it is currently 
confronting. IRS is working diligently to correct its material 
weaknesses. It is therefore important that as IRS continues to make 
progress in this regard, it also enhance its A-123 process to be better 
positioned to support an unqualified statement of assurance on the 
effectiveness of its internal control over financial reporting once its 
material weaknesses have been resolved. 

Recommendations for Executive Action: 

To assist IRS in strengthening its implementation of A-123 reviews in 
future years, we recommend that IRS: 

 document the results of internal control tests conducted in a manner 
sufficiently clear and complete to explain how control procedures were 
tested, what results were achieved, and how conclusions were derived 
from those results, without reliance on supplementary oral explanation; 

 clearly document how it considered existing reviews and audits in 
determining the nature, scope, and timing of procedures it planned to 
conduct under its A-123 process; 

 to the extent that it intends to use the information security work 
conducted under FISMA to meet related A-123 requirements, identify the 
areas where the work conducted under FISMA does not meet the 
requirements of OMB Circular No. A-123 and, considering the findings 
and recommendations of our work on IRS's information security, expand 
FISMA procedures or perform additional procedures as part of the A-123 
reviews to augment FISMA work; 

 revise test plans to include appropriate consideration of the design 
of internal controls in addition to implementation of controls over 
individual transactions; 

 work with Treasury to identify laws and regulations that are 
significant to financial reporting, test controls over compliance with 
those laws and regulations, and evaluate and report on the results of 
such control reviews; 

 begin devising appropriate A-123 follow-up procedures for the last 3 
months of the fiscal year to be implemented once the material 
weaknesses identified through the annual financial statement audits 
have been resolved; and: 

 provide A-123 review staff appropriate training, such as that 
available for financial auditors, to enhance their skills in workpaper 
documentation, identification and testing of internal controls, and 
evaluation and documentation of results. 

Agency Comments and Our Evaluation: 

In commenting on a draft of this report, IRS agreed with our 
recommendations and expressed its appreciation that we acknowledged the 
agency's commitment and diligence in implementing the revised OMB 
Circular No. A-123 requirements during fiscal year 2006. IRS noted that 
it had established a credible A-123 program and used the results of the 
tests conducted to improve IRS's internal control environment. 

IRS agreed with our recommendations to clearly document the results of 
tests conducted and how it considered existing reviews and audits in 
determining the extent of its test procedures, and to provide staff 
involved in the A-123 review process with appropriate training. IRS 
indicated that it had provided enhanced training to testers and 
reviewers in preparation for its fiscal year 2007 A-123 process 
covering such aspects as evaluating audit evidence, preparing 
workpapers, reviewing and evaluating internal controls, and evaluating 
the materiality of errors. IRS also agreed with our recommendation that 
it should revise its test plans to include an appropriate consideration 
of the design of internal controls in addition to implementation of 
controls over individual transactions. IRS stated that it will include 
such analysis of the design for each transaction set tested in its 
fiscal year 2008 A-123 process. 

IRS also agreed with our recommendation that it identify the areas 
where its work conducted under FISMA does not meet A-123 requirements, 
and either expand FISMA procedures or perform additional procedures as 
part of the A-123 reviews to augment its FISMA work. IRS stated that it 
will continue to work with Treasury and us to improve its FISMA 
procedures or A-123 test plans. 

Additionally, IRS agreed with our recommendation that it work with 
Treasury to identify laws and regulations that are significant to 
financial reporting, test controls over compliance with laws and 
regulations, and evaluate and report on the results of such control 
reviews. IRS indicated that it has performed an initial crosswalk of 
laws and regulations significant to financial reporting during fiscal 
year 2007 and will further refine this linkage in preparation for the 
fiscal year 2008 A-123 process. Finally, IRS agreed with our 
recommendation that it devise appropriate A-123 follow-up procedures 
for the last three months of the fiscal year to be implemented once the 
material weaknesses identified through the annual financial statement 
audits have been resolved. IRS stated that in fiscal year 2008, it will 
begin to develop follow-up procedures that provide assurance for the 
last three months of the fiscal year. We will evaluate the 
effectiveness of IRS's efforts in addressing our recommendations during 
our future audits of IRS financial statements. 

This report contains recommendations to you. The head of a federal 
agency is required by 31 U.S.C.  720 to submit a written statement on 
actions taken on these recommendations. You should submit your 
statement to the Senate Committee on Homeland Security and Governmental 
Affairs and the House Committee on Oversight and Government Reform 
within 60 days of the date of this report. A written statement must 
also be sent to the Senate and House Committees on Appropriations with 
the agency's first request for appropriations made more than 60 days 
after the date of the report. 

This report is intended for use by the management of IRS. We are 
sending copies to the Chairmen and Ranking Minority Members of the 
Senate Committee on Appropriations; Senate Committee on Finance; Senate 
Committee on Homeland Security and Governmental Affairs; Subcommittee 
on Taxation and IRS Oversight, and Long-Term Growth, Senate Committee 
on Finance; House Committee on Appropriations; House Committee on Ways 
and Means; and House Committee on Oversight and Government Reform. We 
are also sending copies of this report to the Chairman and Vice 
Chairman of the Joint Committee on Taxation, the Secretary of the 
Treasury, the Director of OMB, the Chairman of the IRS Oversight Board, 
and other interested parties. Copies will be made available to others 
upon request. In addition, the report is available at no charge on 
GAO's Web site at http://www.gao.gov. 

We acknowledge and appreciate the cooperation and assistance provided 
by IRS officials and staff during our review. If you have any questions 
or need assistance in addressing these matters, please contact me at 
(202) 512-3406 or sebastians@gao.gov. GAO staff who made major 
contributions to this report are listed in enclosure III. 

Sincerely yours, 

Signed by: 

Steven J. Sebastian: 
Director: 
Financial Management and Assurance: 

Enclosures: 

[End of section] 

Enclosure I: Comments from the Department of Treasury: 

Department Of The Treasury:
Internal Revenue Service: 
Washington, D.C. 20224: 
Commissioner: 

May 11, 2007: 

Mr. Steven J. Sebastian, Director: 
Financial Management and Assurance: 
U.S. Government Accountability Office: 
441 G Street, N.W. 
Washington, D.C. 20548: 

Dear Mr. Sebastian: 

I am writing in response to the draft Government Accountability Office 
(GAO) report titled "Management Report: IRS's First Year Implementation 
of the Office of Management and Budget's (OMB) Revised Circular No. A- 
123" (GAO-07-692R). 

I appreciate your recognition of our commitment and diligence in 
implementing the revised OMB Circular No. A-123, Management's 
Responsibility for Internal Controls (A-123) in FY 2006. In the first 
year, we established a credible A-123 program within current resources 
and used the test results to improve the internal control environment. 

We have improved our FY 2007 A-123 testing approach through early 
implementation of some of your recommendations, including providing 
enhanced training to testers and reviewers and emphasizing the need for 
thorough documentation of all tests. I have enclosed a response which 
addresses each GAO recommendation. 

We appreciate your recommendations to improve our management controls. 
If you have any questions, please contact Mary E. Davis, Associate 
Chief Financial Officer for Corporate Planning and Internal Control, at 
(202) 622-2955. 

Sincerely, 

Signed for: 

Mark W. Everson: 

Enclosure: 

GAO Recommendations and IRS Responses to GAO Management Report: 

IRS's First Year Implementation of the Office of Management and 
Budget's (OMB) Revised Circular No. A-123 GAO-07-692R: 

Recommendation 1: Document the results of internal control tests 
conducted in a manner sufficiently clear and complete to explain how 
control procedures were tested, what results were achieved, and how 
conclusions were derived from those results, without reliance on 
supplementary oral explanation. 

Comments: We agree with this recommendation. In preparation for the FY 
2007 A-123 process, we delivered a training course on documentation 
requirements for the A-123 testers, incorporating suggestions provided 
by GAO and lessons learned during our FY 2006 implementation. Testers 
also attended an external course focused on the evaluation of audit 
evidence and work paper preparation, and we also instituted additional 
review steps to ensure the work papers provided sufficient support for 
the tea: conclusions. As we prepare for the FY 2008 A-123 cycle, we 
will continue to enhance our in-house training to address the clarity 
and completeness of our explanations. 

Recommendation 2: Clearly document how IRS considered existing reviews 
and audits in determining the nature, scope, and timing of procedures 
it planned to conduct under its A-123 process. 

Comments: We agree with this recommendation. We incorporated 
requirements to document the existing reviews and audits in our FY 2007 
test plan templates. 

Recommendation 3: To the extent that IRS intends to use the information 
security work conducted under FISMA to meet related A-123 requirements, 
identify the areas where the work conducted under FISMA does not meet 
the requirements of OMB Circular No. A-123 and, considering the 
findings and recommendations of our work on IRS's information security, 
expand FISMA procedures or perform additional procedures as part of the 
A-123 reviews to augment FISMA work. 

Comments: We agree with this recommendation. We will continue to work 
with Treasury and GAO to improve either our FISMA procedures or A-123 
test plans. 

Recommendation 4: Revise test plans to include appropriate 
consideration of the design of internal controls in addition to 
implementation of controls over individual transactions. 

Comments: We agree with this recommendation. The FY 2008 A-123 cycle 
will include a requirement to include an analysis of the design for 
each transaction set tested. 

Recommendation 5: Work with Treasury to identify laws and regulations 
that are significant to financial reporting, test controls over 
compliance with those laws and regulations, and evaluate and report on 
the results of such control reviews. 

Comments: We agree with this recommendation. In FY 2007 we performed an 
initial crosswalk of the laws and regulations significant to financial 
reporting to our test plans. We will further refine this linkage in 
preparation for our FY 2008 A-123 process. 

Recommendation 6: Begin devising appropriate A-123 follow-up procedures 
for the last three months of the fiscal year to be implemented once the 
material weaknesses identified through the annual financial statement 
audits have been resolved. 

Comments: We agree with this recommendation. Although implementation of 
such procedures is not necessary until elimination of the outstanding 
material weaknesses, we will begin to develop follow-up procedures in 
FY 2008 that provide assurance for the last three months of the fiscal 
year. 

Recommendation 7: Provide A-123 review staff appropriate training, such 
as that available for financial auditors, to enhance their skills in 
workpaper documentation, identification and testing of internal 
controls, and evaluation and documentation of results. 

Comments: We agree with this recommendation. As indicated under 
recommendation number 1, we provided testers and reviewers with 
enhanced training for the FY 2007 A-123 cycle. The training was 
designed to improve proficiency in documentation and analysis in the 
reviews, including the process to be followed when reviewing or 
performing tests of internal controls, determining if the controls are 
functioning appropriately, and evaluating the materiality of errors. We 
will continue to provide annual training at the beginning of each A-123 
cycle. 

[End of section] 

Enclosure II: Staff Acknowledgments: 

Acknowledgments: 

The following individuals made major contributions to this report: 
Charles Fox, Assistant Director; Charles Ego; Nina Crocker; John Davis; 
Ted Hu; Jerrod O'Nelio; John Sawyer; Angel Sharma; Cynthia Teddleton; 
and Truc Tuck. 

(196151): 

FOOTNOTES 

[1] GAO, Financial Audit: IRS's Fiscal Years 2006 and 2005 Financial 
Statements, GAO-07-136 (Washington, D.C.: Nov. 9, 2006). 

[2] FISMA was enacted as Title III of the E-Government Act of 2002, 
Pub. L. No. 107-347, 116 Stat. 2946 (Dec. 17, 2002). 

[3] Pub. L. No. 107-204, 116 Stat. 745 (July 30, 2002). 

[4] OMB Circular No. A-123, at App. A, Part 1, at p. 20 (rev. Dec 21, 
2004). 

[5] The CFOC, established pursuant to the CFO Act of 1990 (Pub. L. No. 
101-576,  302, 104 Stat. 2838, 2848 [Nov. 15, 1990]), is an 
organization of Chief Financial Officers (CFO) and Deputy CFOs of the 
largest Federal agencies and senior officials of OMB and Treasury. The 
purpose of the council is to advise and coordinate the activities of 
the agencies of its members on such matters as consolidation and 
modernization of financial systems, improved quality of financial 
information, financial data and information standards, internal 
controls, legislation affecting financial operations and organizations, 
and any other financial management matter. The Deputy Director for 
Management of OMB is the CFOC's chair. 

[6] The PCIE--which is governed by Executive Order No. 12805 of May 11, 
1992--was established to (1) address integrity, economy, and 
effectiveness issues that transcend individual government agencies and 
(2) increase the professionalism and effectiveness of inspectors 
general personnel throughout the government. The PCIE is composed 
primarily of the presidentially appointed inspectors general. Officials 
from OMB, the Federal Bureau of Investigation, Office of Government 
Ethics, Office of Special Counsel, and Office of Personnel Management 
serve on the PCIE as well. The PCIE acts as a liaison with the CFOs by 
attending the CFOC meetings and participating and planning joint 
meetings, sessions, and task forces. 

[7] OMB, Implementation Guide for OMB Circular A-123, Management's 
Responsibility for Internal Control. Appendix A, Internal Control Over 
Financial Reporting (Washington, D.C.: July 2005). 

[8] Pub. L. No. 101-576, 104 Stat. 2838 (Nov. 5, 1990). The 24 CFO Act 
agencies are listed at 31 U.S.C.  901(b). 

[9] Treasury determined that every Treasury's consolidated financial 
statement line item greater than 1.5 percent of the section total is 
material to Treasury. Further, if a bureau contributed 10 percent or 
more of the balance of one of these material line items, Treasury 
directed that the bureau must test the applicable process transaction 
controls for A-123 purposes. 

[10] Pub. L. No. 104-208, div. A, 101(f), title VIII, 110 Stat. 3009, 
3009-389 (Sept. 30, 10996). 

[11] GAO, Financial Audit: IRS's Fiscal Years 2005 and 2004 Financial 
Statements, GAO-06-137 (Washington, D.C.: Nov. 10, 2005). 

[12] GAO-06-137. 

[13] With a sample size of 45 items, the auditor concludes that if more 
than one deviation is found, the controls being tested are not 
operating effectively. GAO/PCIE, Financial Audit Manual, section 
450.13, GAO-01-765G (Washington, D.C.: July 2001). 

[14] 26 U.S.C.  6325. 

[15] See 31 U.S.C.  1341(a)(1) and 31 U.S.C.  1517(a). 

[16] Codified, as amended, in part of at 31 U.S.C.  3902(a), (b), and 
(f) and 31 U.S.C.  3904. 

[17] GAO, Information Security: Further Efforts Needed to Address 
Significant Weaknesses at the Internal Revenue Service, GAO-07-364 
(Washington, D.C.: Mar. 30, 2007). 

[18] GAO-06-137. 

[19] In addition to its qualified A-123 statement of assurance on the 
effectiveness of its internal control over financial reporting as of 
June 30, 2006, IRS also provided a statement of qualified assurance 
concerning the effectiveness of its internal control over financial 
reporting, compliance with laws and regulations, and performance 
reporting as of September 30, 2006, in the management representation 
letter it provided to us as part of our audit of IRS's fiscal year 2006 
financial statements. Due to the existence of four material weaknesses 
in IRS's internal control, we rendered our opinion directly on the 
effectiveness of IRS's internal control as of September 30, 2006, 
rather than on its assurance statement. However, once our tests of 
IRS's internal control, including control over financial reporting, 
determine that IRS has resolved all its material weaknesses and IRS 
provides the related unqualified statement of assurance on its overall 
internal control as of September 30, we will render our opinion on 
IRS's internal control based on the appropriateness of IRS's assurance 
statement. 

GAO's Mission: 

The Government Accountability Office, the audit, evaluation and 
investigative arm of Congress, exists to support Congress in meeting 
its constitutional responsibilities and to help improve the performance 
and accountability of the federal government for the American people. 
GAO examines the use of public funds; evaluates federal programs and 
policies; and provides analyses, recommendations, and other assistance 
to help Congress make informed oversight, policy, and funding 
decisions. GAO's commitment to good government is reflected in its core 
values of accountability, integrity, and reliability. 

Obtaining Copies of GAO Reports and Testimony: 

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through GAO's Web site (www.gao.gov). Each weekday, GAO posts 
newly released reports, testimony, and correspondence on its Web site. 
To have GAO e-mail you a list of newly posted products every afternoon, 
go to www.gao.gov and select "Subscribe to Updates." 

Order by Mail or Phone: 

The first copy of each printed report is free. Additional copies are $2 
each. A check or money order should be made out to the Superintendent 
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 
more copies mailed to a single address are discounted 25 percent. 
Orders should be sent to: 

U.S. Government Accountability Office 441 G Street NW, Room LM 
Washington, D.C. 20548: 

To order by Phone: Voice: (202) 512-6000 TDD: (202) 512-2537 Fax: (202) 
512-6061: 

To Report Fraud, Waste, and Abuse in Federal Programs: 

Contact: 

Web site: www.gao.gov/fraudnet/fraudnet.htm E-mail: fraudnet@gao.gov 
Automated answering system: (800) 424-5454 or (202) 512-7470: 

Congressional Relations: 

Gloria Jarmon, Managing Director, JarmonG@gao.gov (202) 512-4400 U.S. 
Government Accountability Office, 441 G Street NW, Room 7125 
Washington, D.C. 20548: 

Public Affairs: 

Paul Anderson, Managing Director, AndersonP1@gao.gov (202) 512-4800 
U.S. Government Accountability Office, 441 G Street NW, Room 7149 
Washington, D.C. 20548: