Management Report:

Improvements Needed in IRS's Internal Controls

GAO-08-368R: Published: Jun 4, 2008. Publicly Released: Jun 4, 2008.

Additional Materials:

Contact:

Cheryl E. Clark
(202) 512-3000
clarkce@gao.gov

 

Office of Public Affairs
(202) 512-4800
youngc1@gao.gov

In November 2007, we issued our report on the results of our audit of the Internal Revenue Service's (IRS) financial statements as of, and for the fiscal years ending, September 30, 2007, and 2006, and on the effectiveness of its internal controls as of September 30, 2007. We also reported our conclusions on IRS's compliance with significant provisions of selected laws and regulations and on whether IRS's financial management systems substantially comply with the requirements of the Federal Financial Management Improvement Act of 1996 (FFMIA). The purpose of this report is to discuss issues identified during our audit of IRS's financial statements as of, and for the fiscal year ending, September 30, 2007, regarding internal controls that could be improved for which we currently do not have a specific recommendation outstanding. Although not all of these issues were discussed in our fiscal year 2007 audit report, they all warrant management's consideration. This report contains 24 recommendations that we are proposing IRS implement to improve its internal controls. We will issue a separate report on the implementation status of recommendations from our prior IRS financial audits and related financial management reports, including this one. We conducted our audit in accordance with U.S. generally accepted government auditing standards.

During our audit of IRS's fiscal year 2007 financial statements, we identified several internal control matters not addressed by previous recommendations. These matters concern the following: summary information reported in the Interim Revenue Accounting Control System (IRACS), IRS's general ledger system for tax-related transactions, could not be traced to the underlying detailed transaction records. Supervisory review procedures for IRS's unpaid assessments estimation process were not effective in preventing or detecting errors. Controls over computer programs affecting penalty assessments did not ensure that the programs always functioned in accordance with IRS's policies and procedures. Documentation of off-site Taxpayer Assistance Center (TAC) managers' reviews was not always readily available and, when provided, lacked the information needed to effectively assess the internal control environment at 5 of the 10 TACs we visited. In addition, these managers lacked clear, comprehensive, and up-to-date guidance for conducting and documenting TAC reviews. Computer access rights of employees responsible for processing cash deposits were not properly restricted to prevent unauthorized adjustments to certain taxpayer account information at 4 of the 10 TACs we visited. First responders to duress alarms were not always qualified or located to effectively respond to emergencies at 5 of the 10 TACs we visited. Documentary evidence demonstrating that background investigations--with favorable results--had been completed for contractors before they were given unescorted access to the facilities was not obtained at six TACs and three field offices we visited. Documentary evidence that background investigations--with favorable results--had been completed for contractors working at off-site shredding facilities was not obtained before they were given access to taxpayer and sensitive information. IRS also was not performing periodic, unannounced inspections of these facilities. New policies and procedures for hiring juveniles were not fully implemented. Evidence of supervisory reviews of documentation demonstrating compliance with key controls related to the processing of Tax Exempt/Government Entity (TE/GE) user fees was lacking. Key controls over IRS's purchase card program were not adequate. Information on new assets was not always recorded in IRS's property and equipment inventory system within required time frames. Travel authorizations for employees were not always approved before travel was initiated. These internal control matters increase the risk that IRS may fail to prevent or timely detect (1) errors in financial data and reporting, computer-generated penalty assessments, and user fee processing; (2) the loss, theft, or misuse of taxpayer receipts, information, and government property; (3) improper or fraudulent procurement; and (4) unauthorized travel.

Recommendations for Executive Action

  1. Status: Closed - Implemented

    Comments: GAO's fiscal year 2010 audit found that IRS's financial management systems substantially complied with the U.S. Standard General Ledger (USSGL) at the transaction level. GAO determined that the Redesigned Revenue Accounting and Control System (RRACS) posted revenue and refund transactions in substantial conformance with the USSGL. In addition, GAO found that IRS recorded taxes receivable in substantial conformance with the USSGL because adjustments were recorded in accordance with the USSGL, and the reported gross taxes receivable balance could be traced through the adjustments to the unadjusted federal taxes receivable balance, and from there to underlying transaction detail, which had also been recorded in accordance with the USSGL.

    Recommendation: The Commission of Internal Revenue should direct appropriate IRS officials to verify that when it becomes fully operational, Custodial Detail Data Base (CDDB), when used in conjunction with IRACS, will provide IRS with the direct transaction traceability for all of its tax-related transactions as required by the U.S. Government Standard General Ledger (SGL) and Federal Financial Management Systems Requirements (FFMSR), and thus FFMIA.

    Agency Affected: Department of the Treasury: Internal Revenue Service

  2. Status: Closed - Implemented

    Comments: During fiscal year 2010, IRS finalized documentation detailing the specific procedures to be performed by IRS's statistician in each step of the unpaid assessment estimation process. GAO confirmed that IRS implemented these detailed steps as part of its formal unpaid assessments estimation process during fiscal year 2010.

    Recommendation: The Commissioner of Internal Revenue should direct appropriate IRS officials to document and implement the specific procedures to be performed by the statistician in each step of the unpaid assessments estimation process.

    Agency Affected: Department of the Treasury: Internal Revenue Service

  3. Status: Closed - Implemented

    Comments: During fiscal year 2010, IRS finalized documentation detailing the specific procedures to be performed by supervisors in reviewing the work of its statistician in preparing IRS's unpaid assessments statistical estimates. The guidance includes specific procedures to ensure: (1) the statistical validity of the sampling plans, (2) data entered into the sample selection programs agree with the sampling plans, (3) data entered into the statistical projection programs agree with IRS's sample review results, (4) data on the spreadsheets used to compile the interim projections and roll-forward results trace back to supporting statistical projection results, and (5) the calculations on these spreadsheets are mathematically correct. GAO confirmed that IRS implemented these detailed steps as part of its formal unpaid assessments estimation process during fiscal year 2010.

    Recommendation: The Commissioner of Internal Revenue should direct appropriate IRS officials to document and implement specific detailed procedures for reviewers to follow in their review of unpaid assessments statistical estimates. Specifically, IRS should require that a detailed supervisory review be performed to ensure: (1) the statistical validity of the sampling plans, (2) data entered into the sample selection programs agree with the sampling plans, (3) data entered into the statistical projection programs agree with IRS's sample review results, (4) data on the spreadsheets used to compile the interim projections and roll-forward results trace back to supporting statistical projection results, and (5) the calculations on these spreadsheets are mathematically correct.

    Agency Affected: Department of the Treasury: Internal Revenue Service

  4. Status: Closed - Implemented

    Comments: IRS changed the computer program for calculating accuracy related penalties in its Business Master File to assign the effective date of the accuracy penalty to match the date of the related deficiency assessment. The change makes the assessment of accuracy related penalties in its Business Master File consistent with how IRS calculates accuracy-related penalties in its Individual Master File. GAO reviewed IRS's documentation showing the implementation of the programming change as well as the results of its internal tests and verified that the programming change functioned as intended.

    Recommendation: To address the inconsistency in assigning the effective date of an accuracy penalty, the Commissioner of Internal Revenue should direct the appropriate IRS officials to modify the Business Master File (BMF) computer program so that the date of the deficiency assessment is used as the effective date of any related accuracy penalty.

    Agency Affected: Department of the Treasury: Internal Revenue Service

  5. Status: Closed - Implemented

    Comments: GAO confirmed that IRS completed its review of existing master file computer programs that affect penalty calculations and documented a listing of instances in which programs are not functioning in accordance with the intent of the Internal Revenue Manual.

    Recommendation: To address other issues that may exist in IRS's master files that affect penalty calculations, the Commissioner of Internal Revenue should direct appropriate IRS officials to complete and document the review of existing programs in the master files that affect penalty calculations to identify any instances in which programs are not functioning in accordance with the intent of the Internal Revenue Manual (IRM).

    Agency Affected: Department of the Treasury: Internal Revenue Service

  6. Status: Open

    Comments: IRS's efforts to address this recommendation are ongoing. IRS reported that efforts to address this recommendation have been delayed due to implementation of the Affordable Care Act mandates. IRS currently expects to complete its corrective action by September 2015. We will continue to evaluate IRS's actions to address this recommendation during our fiscal year 2014 and future audits.

    Recommendation: To address other issues that may exist in IRS's master files that affect penalty calculations, the Commissioner of Internal Revenue should direct appropriate IRS officials to, in instances where programs are not functioning in accordance with the intent of the IRM, take appropriate action to correct the programs so that they function in accordance with the IRM.

    Agency Affected: Department of the Treasury: Internal Revenue Service

  7. Status: Closed - Implemented

    Comments: GAO verified that all of the reviews assessing controls over taxpayer receipts and information are documented in the TSRRD. IRS also stated that managers and staff were required to participate in CPE training on how to use the TSRRD and certify completion prior to filing season, and that Group Managers in place reviewed the Filing Season Readiness Workshop.

    Recommendation: The Commissioner of Internal Revenue should direct appropriate IRS officials to develop and provide comprehensive guidance to assist TAC managers in conducting reviews of outlying TACs and documenting the results. This guidance should include a description of the key controls that should be in place at outlying TACs, specify how often these key controls should be reviewed, and specify how the results of each review should be documented, including follow-up on issues identified in previous TAC reviews.

    Agency Affected: Department of the Treasury: Internal Revenue Service

  8. Status: Closed - Implemented

    Comments: GAO confirmed that IRS established a process to periodically update and communicate the specific required reviews for all off-site Taxpayer Assistance Center (TAC) managers through quarterly reminders and reviewing and monitoring the status of corrective actions noted during operational reviews. In addition, IRS outlined the reviews that TAC managers are required to conduct in its Internal Revenue Manual.

    Recommendation: The Commissioner of Internal Revenue should direct appropriate IRS officials to establish a process to periodically update and communicate the specific required reviews for all off-site TAC managers.

    Agency Affected: Department of the Treasury: Internal Revenue Service

  9. Status: Closed - Implemented

    Comments: IRS mandated the use of the restrict command codes to Taxpayer Assistance Center (TAC) employees accepting cash payments to limit their system access rights and ability to adjust taxpayer accounts. These procedures are monitored during operational reviews conducted by area and territory managers, at which time group managers are reminded of the existing requirements to restrict command codes.

    Recommendation: The Commissioner of Internal Revenue should direct appropriate IRS officials to establish a mechanism to monitor compliance with the existing requirement that TAC employees responsible for accepting taxpayer payments in cash have their computer system access appropriately restricted to limit their ability to adjust taxpayer accounts.

    Agency Affected: Department of the Treasury: Internal Revenue Service

  10. Status: Closed - Implemented

    Comments: IRS established procedures in its Internal Revenue Manual requiring quarterly verification that individuals designated as first responders to Taxpayer Assistance Center (TAC) duress alarms are appropriately qualified and geographically located to respond to the potentially dangerous situations in an effective and timely manner.

    Recommendation: The Commissioner of Internal Revenue should direct appropriate IRS officials to establish procedures requiring periodic verification that all individuals designated as first responders to TAC duress alarms are appropriately qualified and geographically located to respond to the potentially dangerous situations in an effective and timely manner.

    Agency Affected: Department of the Treasury: Internal Revenue Service

  11. Status: Closed - Implemented

    Comments: IRS revised the Internal Revenue Manual to specify the qualifications and geographical proximity requirements for individuals designated as first responders and included a provision to require quarterly reviews of this issue.

    Recommendation: The Commissioner of Internal Revenue should direct appropriate IRS officials to modify the IRM to specify qualifications and geographical proximity requirements for individuals designated as first responders to duress alarms at IRS facilities, and to require that the responsibilities and qualifications of all designated first responders be periodically reviewed to verify that over time, they continue to be qualified and appropriately located, and to make any necessary adjustments.

    Agency Affected: Department of the Treasury: Internal Revenue Service

  12. Status: Closed - Implemented

    Comments: Despite IRS's long standing efforts to work with GSA to reach an agreement to obtain documentation demonstrating favorable background checks have been completed for contractors with unescorted access to IRS space, GSA informed IRS that they were unable to provide adjudication service for contractors working in Facility Security Level I, II and partial III facilities. According to IRS, GSA has been compliant in performing background investigations for all government-owned locations, and leased facilities for Levels IV and for 100 percent occupied Level IIIs. IRS took steps to issue new guidance for facilities to enhance physical controls to safeguard assets, including implementation of daytime cleaning in all leased facilities. In May 2010, IRS issued a new directive regarding the cleaning of all IRS space stating that IRS offices will be cleaned during normal business hours only unless appropriate background investigation procedures have been completed to allow staff access. This directive set a new standard requiring, among other things, that cleaners and other building maintenance or contractor/lessor employees should not be provided access cards or keys to IRS space that would allow them access without IRS employees knowing their presence.

    Recommendation: The Commissioner of Internal Revenue should direct appropriate IRS officials to establish procedures to require documentation demonstrating that favorable background checks have been completed for all contractors prior to allowing them access to TAC and other field offices.

    Agency Affected: Department of the Treasury: Internal Revenue Service

  13. Status: Closed - Implemented

    Comments: IRS implemented a National Document Destruction Contract with the National Institute for the Severely Handicapped (NISH) who services 552 (95%) of the 584 facilities needing shredding services. All NISH contracts require that the (1) contractor shall perform background investigations on all employees involved in IRS document destruction and (2) provisions of the contract must allow for, at a minimum, an annual IRS inspection of the contractor facility and operations to ensure the safeguarding of IRS information. For the remaining 32 (5%) facilities not covered under the NISH nationwide contract, IRS provided a Performance Work Statement for Secured Document Destruction Services which has the same requirements as the NISH contract.

    Recommendation: The Commissioner of Internal Revenue should direct appropriate IRS officials to require, in all shredding service contracts, provisions requiring (1) completed background investigations for contractor employees before they are granted access to sensitive IRS information, and (2) periodic, unannounced inspections at off-site shredding facilities by IRS to verify ongoing compliance with IRS safeguards and security requirements.

    Agency Affected: Department of the Treasury: Internal Revenue Service

  14. Status: Closed - Implemented

    Comments: IRS has updated the Internal Revenue Manual to require that IRS personnel conduct periodic, unannounced inspections at off-site contractor facilities entrusted with sensitive IRS information and that the results of the inspections be documented.

    Recommendation: The Commissioner of Internal Revenue should direct appropriate IRS officials to revise the IRM to include a requirement that IRS conduct periodic, unannounced inspections at off-site contractor facilities entrusted with sensitive IRS information, document the results, including identification of any security issues, and verify that the contractor has taken appropriate corrective actions on any security issues observed.

    Agency Affected: Department of the Treasury: Internal Revenue Service

  15. Status: Closed - Implemented

    Comments: GAO confirmed that IRS included language in the National Document Destruction contract with the National Institute for the Severely Handicapped (NISH) and non-NISH contract, Performance Work Statement for Secured Document Destruction Services, requiring that shredding contractor companies report to IRS on a quarterly basis the start date and background investigation completion date for each contractor involved in the destruction of IRS information. IRS established procedures to perform annual random reviews of contractor records to ensure compliance.

    Recommendation: The Commissioner of Internal Revenue should direct appropriate IRS officials to establish procedures to require obtaining and reviewing documentation of completed background investigations for all shredding contractors before granting them access to taxpayer or other sensitive IRS information.

    Agency Affected: Department of the Treasury: Internal Revenue Service

  16. Status: Closed - Implemented

    Comments: GAO found that IRS took corrective action to reinforce existing policies requiring verification of information on Form 13094, including contacting the reference directly and documenting the details of the contact by: (1) conducting training for the employment offices on the use of Form 13094 and hiring juveniles, (2) developing and implementing a centralized quality review process to monitor juveniles hired, (3) implementing a centralized spreadsheet documenting all juvenile hires along with the completion of required documentation for hiring, and (4) establishing a system to maintain copies of all Form 13094s to support monthly audits.

    Recommendation: The Commissioner of Internal Revenue should direct the appropriate IRS officials to reinforce existing policies requiring IRS personnel to use the revised Form 13094 when hiring juveniles.

    Agency Affected: Department of the Treasury: Internal Revenue Service

  17. Status: Closed - Implemented

    Comments: During the fiscal year 2011 audit, GAO found that IRS took corrective action to reinforce existing policies requiring verification of information on Form 13094, including contacting the reference directly and documenting the details of the contact, by: (1) conducting training for the employment offices on the use of Form 13094 and hiring juveniles, (2) developing and implementing a centralized quality review process to monitor juveniles hired, (3) implementing a centralized spreadsheet documenting all juvenile hires along with the completion of required documentation for hiring, and (4) establishing a system to maintain copies of all Form 13094s to support monthly audits.

    Recommendation: The Commissioner of Internal Revenue should direct the appropriate IRS officials to reinforce existing policies requiring IRS personnel to verify the information on Form 13094 by contacting the reference directly and documenting the details of this contact.

    Agency Affected: Department of the Treasury: Internal Revenue Service

  18. Status: Closed - Implemented

    Comments: GAO verified that IRS issued a memorandum to its operations manager of Receipt and Control to reinforce procedures in its Internal Revenue Manual (IRM) requiring signed supervisory review of user fee deposits. Additionally, during GAO's audit of IRS's fiscal year 2008 financial statements, it did not identify any instances where IRS did not document supervisory review of the user fee deposits tested.

    Recommendation: The Commissioner of Internal Revenue should issue a memorandum to Receipt and Control Operations (RCO) Unit staff reiterating existing requirements for (1) supervisory reviews of the processing of TE/GE user fee deposits, and (2) key documentation to be signed and dated by the supervisor as evidence of that review.

    Agency Affected: Department of the Treasury: Internal Revenue Service

  19. Status: Closed - Implemented

    Comments: GAO confirmed that IRS modified its existing guidelines and fully implemented the Purchase Card Module. However, during GAO's audit of IRS's fiscal year 2008 financial statements, it noted that the purchase card approving official's signature attesting to the review and reconciliation of the monthly statement is now captured electronically by the Purchase Card Module. GAO also noted that the purchase card approving officials were not always electronically reconciling and approving transactions within the required timeframes documented in IRS's existing guidelines. Timely reconciliation and approval of transactions is necessary to help ensure that purchase card transactions are valid and appropriate. GAO issued a new recommendation to address the additional issue in GAO-09-513R, which it subsequently closed (see GAO-10-597) based on further corrective actions taken by IRS.

    Recommendation: The Commissioner of Internal Revenue should direct appropriate IRS officials to modify existing guidelines to require documentation and implementation of detailed internal control procedures for IRS's purchase card program. Specifically, existing guidelines should be modified to provide for detailed internal control procedures requiring that purchase card approving officials and purchase cardholders sign and date monthly account statements attesting to their review and completion of the required reconciliation process.

    Agency Affected: Department of the Treasury: Internal Revenue Service

  20. Status: Closed - Implemented

    Comments: GAO confirmed that IRS modified its existing guidelines and fully implemented the Purchase Card Module. During GAO's audit of IRS's fiscal year 2008 financial statements, it noted that purchase cardholders obtained funding approval electronically through the Purchase Card Module prior to making a purchase. The Purchase Card Module directly interfaces with the funding requisition function of IRS's Web-based Requisition Tracking System to verify funds availability.

    Recommendation: The Commissioner of Internal Revenue should direct appropriate IRS officials to modify existing guidelines to require documentation and implementation of detailed internal control procedures for IRS's purchase card program. Specifically, existing guidelines should be modified to provide for detailed internal control procedures requiring that purchase cardholders obtain funding approval or verify that funds are available for the intended purpose prior to making a purchase.

    Agency Affected: Department of the Treasury: Internal Revenue Service

  21. Status: Closed - Implemented

    Comments: Even though IRS did not modify its existing guidelines to require the purchase card approving official to maintain copies of the purchase cardholder's supporting documentation, GAO confirmed that IRS developed compensating internal control procedures. IRS's existing guidelines require the purchase cardholder to maintain the supporting documentation and for approving officials to ensure that the cardholders have all required documentation. During GAO's audit of IRS's fiscal year 2008 financial statements, it noted that the purchase cardholders maintained appropriate supporting documentation.

    Recommendation: The Commissioner of Internal Revenue should direct appropriate IRS officials to modify existing guidelines to require documentation and implementation of detailed internal control procedures for IRS's purchase card program. Specifically, existing guidelines should be modified to provide for detailed internal control procedures requiring that purchase card approving officials update and maintain appropriate supporting documentation.

    Agency Affected: Department of the Treasury: Internal Revenue Service

  22. Status: Closed - Implemented

    Comments: Even though IRS did not modify its existing guidelines, GAO confirmed that the current guidelines require cardholders to maintain supporting documentation for 3 years. IRS's existing guidelines require the purchase cardholder to maintain the supporting documentation and for approving officials to ensure that the cardholders have all required documentation. During GAO's audit of IRS's fiscal year 2008 financial statements, it noted that the purchase cardholders maintained appropriate supporting documentation.

    Recommendation: The Commissioner of Internal Revenue should direct appropriate IRS officials to modify existing guidelines to require documentation and implementation of detailed internal control procedures for IRS's purchase card program. Specifically, existing guidelines should be modified to provide for detailed internal control procedures requiring that purchase cardholders and purchase card approving officials retain copies of all supporting documents for a reasonable period of time, such as 3 years.

    Agency Affected: Department of the Treasury: Internal Revenue Service

  23. Status: Closed - Implemented

    Comments: IRS issued a memorandum to all personnel responsible for updating inventory dated September 5, 2008. The memorandum reiterated IRS's existing policy requiring that new assets be input into the inventory system within 10 days of receipt and provides additional clarification regarding the timely update of asset inventory records.

    Recommendation: The Commissioner of Internal Revenue should direct appropriate IRS officials to issue a memorandum addressed to all personnel responsible for updating inventory records that reiterates IRS existing policy requiring that new assets be inputted into the inventory system within 10 days after receipt.

    Agency Affected: Department of the Treasury: Internal Revenue Service

  24. Status: Closed - Implemented

    Comments: We verified that IRS published reminders in their Travel Times newsletter and Leader? Alert notification e-mail to remind employees that they must obtain approvals on travel authorizations prior to the initiation of their travel. Furthermore, during our fiscal year 2011 audit we identified only 1 instance out of 41 travel transactions tested where the employee initiated travel prior to obtaining approval for travel.

    Recommendation: The Commissioner of Internal Revenue should direct the appropriate IRS officials to issue a memorandum to employees that reiterates IRS policy requiring all employees to obtain appropriate approval of travel authorizations prior to the initiation of their travel.

    Agency Affected: Department of the Treasury: Internal Revenue Service

 

Explore the full database of GAO's Open Recommendations »

Dec 16, 2014

Nov 19, 2014

Sep 22, 2014

Sep 18, 2014

Aug 11, 2014

Jul 29, 2014

Jul 22, 2014

Jul 18, 2014

Jul 7, 2014

Jul 2, 2014

Looking for more? Browse all our products here