IRS Lockbox Banks:

More Effective Oversight, Stronger Controls, and Further Study of Costs and Benefits are Needed

GAO-03-299: Published: Jan 15, 2003. Publicly Released: Feb 14, 2003.

Additional Materials:

Contact:

Steven J. Sebastian
(202) 512-9521
contact@gao.gov

 

Office of Public Affairs
(202) 512-4800
youngc1@gao.gov

Lockbox banks are commercial banks that process certain taxpayer receipts on behalf of the Internal Revenue Service (IRS). Following an incident at a lockbox site during 2001, which involved the loss and destruction of about 78,000 tax receipts totaling more than $1.2 billion, the Senate Committee on Finance asked GAO to examine whether (1) provisions of the contracts under which lockbox banks operate address previously identified problems or might contribute to mishandling of tax receipts, (2) oversight of lockbox banks is adequate, (3) internal controls are sufficient, and (4) IRS and Treasury's Financial Management Service (FMS) had considered the costs and benefits of contracting out the functions performed by lockbox banks.

FMS has contractual agreements with four lockbox banks, which operate 11 lockbox sites at nine locations on IRS's behalf. Of the more than $2 trillion in tax receipts that IRS collected in fiscal year 2002, lockbox banks processed approximately $268 billion. The findings of GAO's study include the following: (1)Nothing inherent in the lockbox contractual agreements would necessarily contribute to mishandling of tax receipts. Although a desire to avoid negative consequences, such as financial or other penalties allowed for by the agreements, could motivate bank employees to make poor decisions, penalty provisions are necessary to help the government address inadequate performance. The results of an ongoing investigation of the 2001 incident may help IRS and FMS determine whether new provisions or modifications to existing provisions are needed. (2) Although IRS and FMS have significantly increased their presence at lockbox sites, oversight of lockbox banks during fiscal year 2002 was not fully effective to ensure that taxpayer data and receipts were adequately safeguarded and properly processed. Inadequate oversight resulted mainly from a lack of clear oversight directives and policies; failure to perform key oversight functions; and conflicting roles and responsibilities of IRS personnel responsible for day-to-day oversight of lockbox banks. (3) Internal controls, including physical security controls, need to be strengthened at IRS lockbox locations. In addition, the processing guidelines under which IRS lockbox banks operate need to be revised to improve receipt-processing controls, employment screening, and courier security. (4) IRS and FMS have not performed a comprehensive study of the costs and benefits of using lockbox banks. The most recent study, in 1999, omitted some costs that may have affected the result. For example, the study did not consider opportunity costs--benefits foregone that might have resulted from alternative uses of the money. Because of these omissions and several changes that have affected costs and benefits, a new study will be needed before lockbox contracts expire in 2007.

Status Legend:

More Info
  • Review Pending-GAO has not yet assessed implementation status.
  • Open-Actions to satisfy the intent of the recommendation have not been taken or are being planned, or actions that partially satisfy the intent of the recommendation have been taken.
  • Closed-implemented-Actions that satisfy the intent of the recommendation have been taken.
  • Closed-not implemented-While the intent of the recommendation has not been satisfied, time or circumstances have rendered the recommendation invalid.
    • Review Pending
    • Open
    • Closed - implemented
    • Closed - not implemented

    Recommendations for Executive Action

    Recommendation: To decrease the likelihood that further incidents involving the loss and destruction of taxpayer receipts and data will occur, we recommend that the Commissioner of FMS and Acting Commissioner of IRS thoroughly review the results of TIGTA's investigation of the 2001 incident at the Pittsburgh lockbox site when it is completed and, if the results warrant, implement additional controls and modify the lockbox contractual agreements as appropriate.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Closed - Implemented

    Comments: IRS's has taken numerous actions to address significant internal issues at lockbox banks. These actions, taken in combination with similar improvements at service center campuses, have reduced the magnitude of remaining internal controls issues to a level that GAO no longer considers remaining issues to consititute a significant deficiency in internal controls. Due to the signficant volume of tapayer receipts and data processed by these locations, GAO will continue to actively monitor the effectiveness of these controls over time.

    Recommendation: To improve internal controls at lockbox banks, the Commissioner of FMS and the Acting Commissioner of IRS should require that internal control deficiencies are corrected by lockbox bank management and that IRS and FMS take steps through ongoing monitoring to ensure that employee access and items brought into and out of processing areas are closely monitored by guards, as mandated by IRS's Lockbox Processing Guidelines.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Closed - Implemented

    Comments: During its fiscal year 2003 IRS financial audit, GAO verified that IRS had taken steps to monitor compliance with this requirement. Additionally, this item is included in FMS' monitoring/oversight checklist used to monitor compliance with this requirement, as well as in the LPG. GAO noted no exceptions during its observations.

    Recommendation: To improve internal controls at lockbox banks, the Commissioner of FMS and the Acting Commissioner of IRS should require that internal control deficiencies are corrected by lockbox bank management and that IRS and FMS take steps through ongoing monitoring to ensure that visitor access to and activity in the processing area are adequately controlled, as mandated by IRS's Lockbox Processing Guidelines.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Closed - Implemented

    Comments: IRS stated that the requirement to control visitor access was previously listed in the 2002 LPG, issued January 1, 2002. During the on-site security reviews, IRS/FMS security teams observe the sites' handling of visitors to ensure that the banks meet this requirement. Additionally, during peak visits, a lockbox coordinator observes adherence to this requirement. The visitor access requirement is documented in Section 2.6.2 of the 2003 LPG, issued January 31, 2003. During its fiscal year 2003 IRS financial audit, GAO verified that the requirement was included in the LPG, and that IRS had taken steps to monitor compliance with this requirement. Additionally, this item is included in FMS' monitoring/oversight checklist.

    Recommendation: To improve internal controls at lockbox banks, the Commissioner of FMS and the Acting Commissioner of IRS should require that internal control deficiencies are corrected by lockbox bank management and that IRS and FMS take steps through ongoing monitoring to ensure that employees' identity and employment status are verified prior to granting access to the processing floor, as mandated by IRS's Lockbox Processing Guidelines.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Closed - Implemented

    Comments: During its fiscal year 2003 IRS financial audit, GAO noted that IRS had taken steps to monitor compliance with this requirement. Additionally, this item is included in FMS' monitoring/oversight checklist used to monitor compliance with this requirement as well as in the LPG. GAO noted no exceptions during its observations.

    Recommendation: To improve internal controls at lockbox banks, the Commissioner of FMS and the Acting Commissioner of IRS should require that internal control deficiencies are corrected by lockbox bank management and that IRS and FMS take steps through ongoing monitoring to ensure that guards are responsive to alarms, as mandated by IRS's Lockbox Processing Guidelines.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Closed - Implemented

    Comments: IRS reported that the Lockbox Security Guidelines (LSG) is no longer included in the Lockbox Processing Guidelines (LPG) to provide more emphasis on security. Beginning in 2006 LSG is a separate document. LSG 2.2.2.4(7) requires that "Bank management is ultimately responsible for access control and procedures for ensuring only authorized personnel are granted access to the processing floor. Bank management must be involved in the day to day access control process. This responsibility cannot be delegated (e.g. to temporary agency personnel, security guards, third parties)." LSG 2.2.3.1 (7) provides the requirements for guards to respond to alarms. The Security Team performs alarm testing and evaluates guards' responses to alarms during their on-site security reviews. Security Performance Measures (effective January 2006) were developed to measure and rate each site's overall adherence to security guidelines and provides incentives/disincentives accordingly. Mission Assurance and FMS Security staff supports the Lockbox Policy and Procedures Program Office in conducting security reviews. Reviews rate each site's compliance to physical, personnel, courier, and information technology (IT) security. GAO verified that the LSG requires lockbox bank management to ensure that guards are responsive to alarms. Additionally, GAO verified that Security Performance Measures are in place to measure and rate each lockbox bank's overall adherence to security guidelines.

    Recommendation: To improve internal controls at lockbox banks, the Commissioner of FMS and the Acting Commissioner of IRS should require that internal control deficiencies are corrected by lockbox bank management and that IRS and FMS take steps through ongoing monitoring to ensure that perimeter doors are locked and alarms on perimeter doors are functioning, as mandated by IRS's Lockbox Processing Guidelines.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Closed - Implemented

    Comments: IRS reported that security teams consisting of individuals from FMS, AWSS, and IRS are responsible for on-site security reviews. Lockbox sites are receiving announced and unannounced security reviews as of November 2002. These reviews monitor management's compliance with this requirement. During its fiscal year 2003 IRS financial audit, GAO verified that IRS had taken steps to monitor compliance with this requirement. Additionally, this item is included in FMS' monitoring/oversight checklist.

    Recommendation: To improve the effectiveness of government oversight of lockbox banks, the Acting Commissioner of IRS should assign individuals, other than the lockbox coordinators, responsibility for completing on-site performance reviews.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Closed - Implemented

    Comments: GAO issued this recommendation in January 2003 when the lockbox coordinators were the only individuals responsible for conducting the performance reviews and at that time these reviews were not being performed because of competing demands. Over the years, IRS and Financial Management Service (FMS) have increased their oversight of the lockbox bank program with various performance and compliance reviews. These reviews include peak season trip reports and annual security reviews conducted jointly by IRS and FMS staff. In addition, IRS has implemented a scorecard system performed, reviewed, and signed by both IRS and FMS that incorporates the results of the reviews. GAO has determined that these procedures collectively satisfy the objective of this recommendation.

    Recommendation: To improve the effectiveness of government oversight of lockbox banks, the Acting Commissioner of IRS should revise the guidance used for compliance reviews so it requires reviewers to (1) determine whether lockbox contractors, such as couriers, have completed and obtained favorable results on IRS fingerprint checks and (2) obtain and review all relevant logs for cash payments and candled items to ensure that all payments are accounted for.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Closed - Implemented

    Comments: IRS reported that it updated the security check sheet in January 2004 to instruct reviewers to determine whether contractors have completed and obtained favorable fingerprint results and to review all relevant logs for cash payments and candling logs. In order to ensure compliance to the Lockbox Processing Guideline (LPG) requirements, an IRS and Financial Management Service (FMS) task group developed a performance measures process to include a category for security (Courier, Physical, Remittance) that was implemented in October 2005. This process which was piloted in 2005 and implemented in January 2006 uses a data collection instrument (DCI) check sheet that lists by line item the requirements as outlined in the LPG. It is used as a tool to identify varying levels of performance and provide incentives and disincentives based on those levels of performance. This helps the IRS/FMS Security staff ensure compliance with the LPG requirements. Additionally, an internal control review is included in the reviews performed quarterly by the Lockbox coordinators. During its fiscal year 2005 audit, GAO verified that the lockbox coordinator's on-site review check sheet included the requirement to ensure that the cash and candling logs are being kept and updated daily and that contractors have completed and obtained favorable results on IRS fingerprint checks.

    Recommendation: To improve the effectiveness of government oversight of lockbox banks, the Acting Commissioner of IRS should ensure that the results of on-site compliance reviews are completed and promptly submitted to IRS's National Office.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Closed - Implemented

    Comments: IRS reported that all lockbox banks underwent security reviews in 2003 and 2004. The banks were required to respond officially to the items identified in the security report. Security reviews were based on the lockbox sites' compliance with the LPG. IRS is represented on the security review team, provides input related to the review to FMS, and then receives a copy of the final response sent by FMS to the lockbox bank. Reviews were submitted to the National Office in a timely manner. Document Collection Instrument (DCI) reviews were examined for completeness and accuracy. During the fiscal year 2004 audit, GAO reviewed the results of IRS and FMS April peak-season security reviews, captured in joint IRS/FMS consolidated trip reports for each lockbox site, and concluded there these reviews were completed and submitted to IRS's National Office in a timely manner.

    Recommendation: To improve the effectiveness of government oversight of lockbox banks, the Acting Commissioner of IRS should establish and document a process in IRS policy and procedure manuals to ensure that IRS officials with the appropriate levels of expertise continue to participate in announced and unannounced security reviews of lockbox banks.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Closed - Implemented

    Comments: IRS reported that the Memorandum of Understanding (MOU) documents the roles and responsibilities of the Security Review team, which conducts announced and unannounced security reviews. The security review team consists of FMS and IRS security experts. During its fiscal year 2003 IRS financial audit, GAO verified that the roles and responsibilities of the security review team were documented in the MOU.

    Recommendation: To improve the effectiveness of government oversight of lockbox banks, the Commissioner of FMS and the Acting Commissioner of IRS should establish and document a process in IRS and FMS policy and procedure manuals to ensure that lockbox bank management formally responds to IRS and FMS oversight findings and recommendations promptly and that corrective actions taken by lockbox bank management are appropriate.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Closed - Implemented

    Comments: IRS reported that the Security MOU, completed on April 1, 2003, documents the roles and responsibilities of the Security Review Team, which is comprised of FMS and IRS security experts. IRS documents its findings, which are sent to FMS to be included in a final report to the banks. This report covers findings, recommendations, and due dates for all corrective actions. IRS receives a copy of the final report. The IRS's oversight roles and responsibilities can be found in the 2005 Lockbox Processing Guidelines (LPG) under 2.1.2.2, Revenue and Deposit Branch, Lockbox Policy and Procedures (LPP), LPG 2.1.2.3, Revenue and Deposit Branch, Lockbox Field Operations (LFO) and the Lockbox IRM 3.0.230. Specifically, the LPG, which the lockbox banks are required to follow, states that IRS's Tax Payment Management Branch will determine, in conjunction with FMS and Lockbox Field Operations, if actions need to be taken as a result of lockbox performance measures, and that this Branch will update the LPG as needed. During fiscal year 2004, GAO verified that IRS outlined the oversight duties and responsibilities for FMS and IRS in the IRM and in the 2004 LPG. In addition, IRS also documented the oversight roles and responsibilities in the 2005 LPG.

    Recommendation: To improve the effectiveness of government oversight of lockbox banks, the Commissioner of FMS and the Acting Commissioner of IRS should finalize and document the recently developed waiver process in IRS and FMS policy and procedure manuals and ensure that decisions on requests for waivers are formally and promptly communicated to lockbox management

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Closed - Implemented

    Comments: IRS reported that the new waiver process is described in section 2.1.3.1 of the January 2003 LPG document. The Office of Program Evaluation and Risk Analysis documented the internal process between IRS and FMS in the Security Memorandum of Understanding (MOU). During its fiscal year 2003 IRS financial audit, GAO verified that the new waiver process is described in the January 2003 LPG and that the internal process between IRS and FMS is documented in the MOU.

    Recommendation: To improve the effectiveness of government oversight of lockbox banks, the Commissioner of FMS and the Acting Commissioner of IRS should establish and document guidelines and procedures in IRS and FMS policy and procedure manuals for implementing the new penalty provision for lockbox banks to reimburse the government for direct costs incurred in correcting errors made by lockbox banks.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Closed - Implemented

    Comments: IRS and the Financial Management Service (FMS) prepared a reimbursement process. The procedures include the use of a special Lockbox Program code to delineate IRS rework costs as a result of errors made by the lockbox sites. The Lockbox Policy Reimbursement procedures are included in the 2005 LPG under LPG 2.1.9 and 2005 Lockbox Processing Procedures under IRM 3.0.230.9.3. During its fiscal year 2005 audit, GAO verified that IRS had incorporated reimbursement procedures in the 2005 LPG.

    Recommendation: To improve the effectiveness of government oversight of lockbox banks, the Commissioner of FMS and the Acting Commissioner of IRS should document IRS's and FMS's oversight roles and responsibilities in agency policy and procedure manuals and determine the appropriate level of IRS and FMS oversight of lockbox sites throughout the year, particularly during peak processing periods.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Closed - Implemented

    Comments: The Memorandum of Understanding (MOU) between the Financial Management Service (FMS) and IRS detailing the roles and responsibilities of each organization in administering the IRS Lockbox Program, was signed April 30, 2003. In addition, IRM 3.0.230, Lockbox Processing Procedures, and the LPG (2003 and 2004) outline the duties and responsibilities of FMS and IRS. During its audit of IRS's fiscal year 2004 financial statements, GAO confirmed that IRS's MOU was incorporated into an update of the IRM and in the 2004 LPG.

    Recommendation: To improve internal controls at lockbox banks, the Commissioner of FMS and the Acting Commissioner of IRS should require that internal control deficiencies are corrected by lockbox bank management and that IRS and FMS take steps through ongoing monitoring to ensure that surveillance cameras and monitors are installed in ways that allow for effective, real-time monitoring of lockbox operations, as mandated by IRS's Lockbox Processing Guidelines.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Closed - Implemented

    Comments: IRS reported that surveillance cameras have been installed at all lockbox sites. Security review teams continually monitor compliance. These procedures were updated in Section 2.4.1 of the 2003 (revised April 8, 2003) and the 2004 LPG, issued December 1, 2003. The 2005 LPG, under LPG 4.1.4.1.4, directs the documentation of the role and responsibilities for closed-circuit television (CCTV) monitoring by security guards. To help ensure compliance to the LPG requirements, an IRS and FMS task group has developed a Performance Measures process to include a category for Security and Internal Control to be piloted January through September 2005 and to be implemented October 2005. This process will utilize a DCI check sheet that will list by line items the requirements as outlined in the LPG. It will be used as a tool to identify varying levels of performance and provide incentives and disincentives based on those levels of performance. This will help ensure compliance with the requirements as set forth in the LPG and will help IRS identify if and where improvements are necessary. During the fiscal year 2004 audit, GAO found no instances in which a bank did not have surveillance cameras and monitors installed that allowed for effective, real-time monitoring of lockbox operations at the four lockbox banks we visited.

    Recommendation: To improve internal controls at lockbox banks, the Commissioner of FMS and the Acting Commissioner of IRS should require that internal control deficiencies are corrected by lockbox bank management and that IRS and FMS take steps through ongoing monitoring to ensure that envelopes are properly candled, as mandated by IRS's Lockbox Processing Guidelines.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Closed - Implemented

    Comments: Effective October 2005, IRS began conducting candling reviews at all Lockbox bank sites to ensure all candling requirements are met. These internal control reviews ensure that envelopes opened (manually or by OPEX) on three or more sides are candled once and that envelopes other than the ones opened on three or more sides are candled twice. The results of these reviews are used to calculate each bank's performance score. As a result of implementing these measures in the first year, an unfavorable score can result in IRS deeming the subject bank ineligible to bid for new work or additional volume, loss of current work, or placing the bank in a probationary status. GAO verified that lockbox management conducts reviews to ensure that envelopes are properly candled. During its audit of IRS's fiscal year 2006 financial statements, it did not find any instances in which envelopes were not being properly candled at the four lockbox banks that it visited.

    Recommendation: To improve internal controls at lockbox banks, the Commissioner of FMS and the Acting Commissioner of IRS should require that internal control deficiencies are corrected by lockbox bank management and that IRS and FMS take steps through ongoing monitoring to ensure that lockbox bank management perform and adequately document candling reviews, as mandated by IRS's Lockbox Processing Guidelines.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Closed - Implemented

    Comments: IRS stated that the 2005 LPG 3.2.8.3, Documentation of Items Found in Candling (Form 9535) (1), was revised to require the responsible manager to initial the Form 9535 everyday for each shift. An entry must be made each shift, whether or not items have been found. A manager will initial Form 9535 to validate all of the following: (1) all available information is correctly entered, (2) items found have been reconciled with Form 9535 entries, (3) items have been correctly categorized as "processable" or "unprocessable," (4) all "processable" work has been cleared after each shift, i.e. the work has been put back into the stream of work, and (5) the received date has been correctly entered. Additionally under LPG 3.2.8, IRS revised the requirement to state that envelopes opened manually or by OPEX mail machine are required to be candled once; all others must be candled twice. In order to help ensure compliance to the LPG requirements, an IRS and FMS task group has developed a Performance Measures process to include a category for Security and Internal Control, which will be implemented in October 2005. This process will utilize a DCI check sheet that will list by line items the requirements as outlined in the LPG. It will be used as a tool to identify varying levels of performance and provide incentives and disincentives based on those levels of performance. This will help ensure compliance with the requirements as set forth in the LPG and will help us identify if and where improvements are necessary. During the fiscal year 2004 audit, GAO found that management at the four lockbox banks it visited performed and adequately documented candling reviews.

    Recommendation: Regardless of the type of analysis chosen, the Secretary of the Treasury should (1) clearly define the type of analysis being done and why, and follow through to identify and analyze costs and benefits relevant to the type of analysis; (2) consider the opportunity costs associated with the proposed investment in using lockbox banks to accelerate the deposit of tax receipts; and (3) include the direct costs associated with oversight, risk reduction, and non-Form 1040 tax receipts.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Closed - Implemented

    Comments: IRS reported that it and FMS are continuing to analyse how best to satisfy the IRS's remittance processing needs. IRS reported that it and FMS would complete this analysis prior to the expiration of the current lockbox agreements. GAO will continue to evaluate IRS's progress on this issue as part of its annual IRS financial statement audits.

    Recommendation: Because IRS and FMS must decide before 2007 whether to continue using lockbox banks to process tax receipts or to return that function to IRS, the Secretary of the Treasury should conduct a study, which should be done in time (1) for its findings to be considered in the decision-making process and (2) to make any improvements to lockbox processing that the study indicates are necessary or to return the processing to IRS.

    Agency Affected: Department of the Treasury

    Status: Closed - Implemented

    Comments: IRS and FMS completed this analysis prior to the expiration of the current lockbox agreements.

    Recommendation: To improve internal controls at lockbox banks, the Commissioner of FMS and the Acting Commissioner of IRS should revise the lockbox processing guidelines to require that lockbox employees immediately seek processing guidance from the lockbox coordinator if envelopes with timely postmark dates are received after the postmark review period has ended.

    Agency Affected: Department of the Treasury

    Status: Closed - Implemented

    Comments: The January 1, 2003, LPG included a requirement for a lockbox site to notify the SPC Lockbox Coordinator if it receives timely postmarked mail after the grace period. The Lockbox Coordinator will provide instructions for processing and assess the need for further postmark review. During its fiscal year 2003 IRS financial audit, GAO verified that the LPG had been revised to incorporate this requirement.

    Recommendation: To improve internal controls at lockbox banks, the Commissioner of FMS and the Acting Commissioner of IRS should revise the lockbox processing guidelines to require that lockbox bank management reconcile cash payments to internal cash logs and the cash logs they provide to IRS.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Closed - Implemented

    Comments: IRS reported that all cash receipts are documented on Form 9535. LPG 2003 was updated on January 31, 2003, to include the requirement to document immediately and for management to reconcile payments. During its fiscal year 2003 IRS financial audit, GAO verified that the LPG had been revised to incorporate this requirement. During the fiscal year 2004 IRS financial audit, GAO did not identify any instances during its visits to four lockbox banks where cash payments were not reconciled to the internal cash logs that lockbox bank management provided to IRS.

    Recommendation: To improve internal controls at lockbox banks, the Commissioner of FMS and the Acting Commissioner of IRS should revise the lockbox processing guidelines to require that lockbox bank management reconcile items found during candling to the candling records.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Closed - Implemented

    Comments: IRS reported that instructions for candling have been revised to require management to reconcile items to the Form 9535. The 2003 LPG was updated on January 31, 2003, per Lockbox Electronic Bulletin alert, to include this requirement in the LPG. During its fiscal year 2003 IRS financial audit, GAO verified that the LPG had been revised to incorporate this requirement. During the fiscal year 2004 audit, GAO did not identify any instances during its visits to four lockbox banks where lockbox bank management did not reconcile items found during candling to the candling records.

    Recommendation: To improve internal controls at lockbox banks, the Commissioner of FMS and the Acting Commissioner of IRS should revise the lockbox processing guidelines to require that, during candling, lockbox bank employees record which machines and which extraction clerks missed items.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Closed - Implemented

    Comments: IRS reported that on April 2, 2003, it instructed the banks to change the quality review process for candling. The new procedures require that banks track which machines and which employees missed items. The procedures were effective April 14, 2003, and included in the 2004 LPG, issued December 1, 2003. During the fiscal year 2004 audit, GAO verified that procedures requiring that lockbox banks track which machines and which employees missed items were included in the 2004 LPG. In its visits to four lockbox banks, GAO did not identify any instances where lockbox bank employees did not record which machines and which extraction clerks missed items during candling.

    Recommendation: To improve internal controls at lockbox banks, the Commissioner of FMS and the Acting Commissioner of IRS should revise the lockbox processing guidelines to require that candling procedures for the various types of extraction methods be clarified.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Closed - Implemented

    Comments: IRS reported that in the 2003 LPG, Section 3.2.8, effective January 1, 2003, candling procedures for the various types of extraction methods were clarified. Splitting the envelope on three sides and flattening the envelope is sufficient to meet candling requirements. This process is sufficient to meet the candling requirements without further light source viewing. All other methods of extraction require viewing the envelope twice, through a light source. During its fiscal year 2003 IRS financial audit, GAO verified that the LPG revision clarified the candling procedures for the various types of extraction methods.

    Recommendation: To improve internal controls at lockbox banks, the Commissioner of FMS and the Acting Commissioner of IRS should revise the lockbox processing guidelines to require that lockbox bank guards inspect courier vehicles for unauthorized passengers and unlocked doors.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Closed - Implemented

    Comments: IRS reported that the 2003 LPG, Section 2.7.4, which was effective January 1, 2003, was updated to include this requirement. During its fiscal year 2003 IRS financial audit, GAO reviewed a Lockbox Electronic Bulletin alert that revised the LPG to require that guards inspect courier vehicles for unauthorized passengers and unlocked doors. GAO did not identify any instances where guards did not inspect courier vehicles for unauthorized passengers and unlocked doors during the fiscal year 2003 audit.

    Recommendation: To improve internal controls at lockbox banks, the Commissioner of FMS and the Acting Commissioner of IRS should revise the lockbox processing guidelines to require that, before permanent lockbox bank employees receive access to taxpayer data and receipts, they undergo and receive favorable results on background investigations that are deemed appropriate by IRS and are consistent across lockbox banks.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Closed - Implemented

    Comments: IRS reported that on September 23, 2003, at the annual Lockbox Conference, NBIC presented the new background investigation requirements for permanent Lockbox bank employees, couriers and guards. The new procedures require a moderate risk National Agency Check with Law and Credit (NACLC) investigation on all permanent bank employees, couriers and guards. The banks were given an implementation schedule beginning October 1, 2003 with full implementation by April 1, 2004. On December 15, 2003, the Lockbox Project Office sent out a Lockbox Electronic Bulletin with the 2004 LPG containing the revised background investigation requirements under L.P.G.4.2, Personnel Security and L.P.G.5.1.2(5). GAO verified that the 2004 LPG was revised to require all permanent employees assigned to a lockbox bank to have a NACLC investigation. GAO did not identify any instances during its fiscal year 2004 audit in which permanent employees with unescorted access to the processing area did not have a NACLC background investigation.

    Recommendation: To improve internal controls at lockbox banks, the Commissioner of FMS and the Acting Commissioner of IRS should revise the lockbox processing guidelines to require that, before lockbox bank couriers receive access to taxpayer data and receipts, they undergo and receive favorable results on background investigations that are deemed appropriate by IRS and are consistent across lockbox banks.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Closed - Implemented

    Comments: IRS reported that on September 23, 2003, at the annual Lockbox Conference, the National Background Investigation Center (NBIC) presented the new background investigation requirements for permanent Lockbox bank employees, couriers, and guards. The new procedures require a moderate risk National Agency Check with Law and Credit investigation on all permanent bank employees, couriers, and guards. The banks were given an implementation schedule beginning October 1, 2003, with full implementation by April 1, 2004. On December 15, 2003, the Lockbox Project Office sent out a Lockbox Electronic Bulletin with the 2004 LPG containing the revised background investigation requirements under L.P.G.4.2, Personnel Security and L.P.G.5.1.2(5). During the fiscal year 2004 audit, GAO verified that the LPG had been revised to require that before lockbox bank couriers receive access to taxpayer data and receipts they undergo and receive favorable results on background investigations. GAO found no instances where couriers received access to taxpayer data and receipts without having undergone and received favorable results on background investigations.

    Recommendation: To improve internal controls at lockbox banks, the Commissioner of FMS and the Acting Commissioner of IRS should require that internal control deficiencies are corrected by lockbox bank management and that IRS and FMS take steps through ongoing monitoring to ensure that employees have received favorable results on fingerprint checks before they are granted access to taxpayer data and receipts, as mandated by IRS's Lockbox Processing Guidelines.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Closed - Implemented

    Comments: The requirement for lockbox sites to obtain favorable results on employees' fingerprint checks before allowing them access to the processing floor was previously listed in the 2002 LPG. The 2003 LPG, Section 2.6.1, effective January 1, 2003, was updated to reflect the new requirements. The FMS and IRS security team reviews personnel files to ensure employees currently working with taxpayer remittances have fingerprint clearance. During its fiscal year 2003 IRS financial audit, GAO verified that the LPG was updated and that IRS has taken steps to monitor compliance.

    Recommendation: To improve internal controls at lockbox banks, the Commissioner of FMS and the Acting Commissioner of IRS should require that internal control deficiencies are corrected by lockbox bank management and that IRS and FMS take steps through ongoing monitoring to ensure that lockbox couriers are properly identified prior to granting them access to taxpayer data and receipts, as mandated by IRS's Lockbox Processing Guidelines.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Closed - Implemented

    Comments: The 2003 LPG, Section 2.7.4, effective January 1, 2003, specifies that guards identify couriers before granting access. Adherence to the requirements was added to the Lockbox Security Check Sheet. Adherence is monitored by the Lockbox FMS and IRS security team during their announced and unannounced security visits. During its fiscal year 2003 IRS financial audit, GAO noted that IRS had taken steps to monitor compliance with this requirement (this item is included in FMS's monitoring/oversight checklist).

    Recommendation: To improve internal controls at lockbox banks, the Commissioner of FMS and the Acting Commissioner of IRS should require that internal control deficiencies are corrected by lockbox bank management and that IRS and FMS take steps through ongoing monitoring to ensure that returned refund checks are restrictively endorsed immediately upon extraction, as mandated by IRS's Lockbox Processing Guidelines.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Closed - Implemented

    Comments: IRS reported that the requirement to ensure that returned refund checks are restrictively endorsed immediately upon extraction was previously listed in Section 3.2.1 of the 2002 Lockbox Processing Guidelines (LPG) issued January 1, 2002, as well as the 2003 (revised April 8, 2003) and 2004 LPG, issued December 1, 2003. During the on-site security reviews, IRS and Financial Management Service security teams reviewed adherence to this requirement. Additionally, adherence to this requirement is evaluated during the daily Submission Processing Center quality reviews. During its fiscal year 2005 audit, GAO did not identify any instances where returned refund checks at the lockbox banks were not restrictively endorsed upon extraction.

    Aug 11, 2014

    Jul 29, 2014

    Jul 22, 2014

    Jul 18, 2014

    Jul 7, 2014

    Jul 2, 2014

    Jun 13, 2014

    May 30, 2014

    May 20, 2014

    Apr 21, 2014

    Looking for more? Browse all our products here