Skip to Highlights
Highlights

This letter summarizes our review of the Internal Revenue Service's (IRS) implementation of the requirements of the Office of Management and Budget's (OMB) revised Circular No. A-123, Management's Responsibility for Internal Control (A-123) during fiscal year 2006. These requirements are applicable to the 24 Chief Financial Officer (CFO) Act agencies, including the Department of the Treasury (Treasury), of which IRS is a significant component. The objectives of our review, which was conducted as part of our audit of IRS's fiscal year 2006 financial statements, were to determine whether (1) IRS appropriately planned and implemented its assessment of internal controls over financial reporting in accordance with the requirements of OMB Circular No. A-123, (2) IRS performed sufficient work to support its related assurance statement to Treasury, and (3) IRS's assurance statement appropriately represented the status of IRS's internal control over financial reporting.

Skip to Recommendations

Recommendations

Recommendations for Executive Action

Agency Affected Recommendation Status
Internal Revenue Service To assist IRS in strengthening its implementation of A-123 reviews in future years, IRS should document the results of internal control tests conducted in a manner sufficiently clear and complete to explain how control procedures were tested, what results were achieved, and how conclusions were derived from those results, without reliance on supplementary oral explanation.
Closed - Implemented
In fiscal year 2008, IRS revised its A-123 Guidance to include templates that clearly outline how to document and explain what control tests were performed, the scope of control tests, and the results of control tests performed. GAO verified that IRS's work papers documenting fiscal year 2008 A-123 testing substantially conformed to the A-123 Guidance.
Internal Revenue Service To assist IRS in strengthening its implementation of A-123 reviews in future years, IRS should clearly document how it considered existing reviews and audits in determining the nature, scope, and timing of procedures it planned to conduct under its A-123 process.
Closed - Implemented
IRS revised its OMB Circular A-123 implementation guidance to document its consideration of prior reviews and audits. In fiscal year 2008, GAO verified that IRS documented how it considered existing reviews and audits in determining the nature, scope, and timing of procedures it planned to conduct under its A-123 process. IRS also included a requirement in its A-123 Guidance to determine the adequacy and value of management actions taken in response to audits performed by GAO and the TIGTA relating to financial reporting. GAO also verified that IRS review staff followed the A-123 Guidance in performing A-123 reviews.
Internal Revenue Service To assist IRS in strengthening its implementation of A-123 reviews in future years, IRS should, to the extent that it intends to use the information security work conducted under FISMA to meet related A-123 requirements, identify the areas where the work conducted under FISMA does not meet the requirements of OMB Circular No. A-123 and, considering the findings and recommendations of our work on IRS's information security, expand FISMA procedures or perform additional procedures as part of the A-123 reviews to augment FISMA work.
Closed - Implemented
In fiscal year 2009, IRS implemented a review process for evaluating controls over information technology relating to financial reporting. The review focused on the systems that affect recording of financial transactions and included assessing the annual FISMA evaluations of CFO oriented financial systems. During GAO's fiscal year 2010 IRS financial audit, it reviewed IRS's OMB A-123 support for its FISMA work related to the evaluation of internal controls over systems that record financial transactions, and its assessment of the annual FISMA report on IRS's information security program to determine if it met OMB A-123 requirements. GAO concluded that IRS's A-123 test procedures related to its FISMA reviews were adequate, appropriately conducted, and documented, in all material respects. GAO also agreed with IRS's conclusion that it met OMB A-123 requirements, in the context of a pre-existing material weakness in information security
Internal Revenue Service To assist IRS in strengthening its implementation of A-123 reviews in future years, IRS should revise test plans to include appropriate consideration of the design of internal controls in addition to implementation of controls over individual transactions.
Closed - Implemented
During GAO's audit of the Internal Revenue service's (IRS) fiscal year 2006 financial statements, it found that IRS did not include appropriate consideration of the design of internal control in its approach to implementing the requirements of OMB Circular A-123, Management's Responsibility for Internal Control. In response to GAO's recommendation to address this issue, IRS expanded its OMB A-123 test plans in fiscal year 2010 to encompass the design of internal control. During GAO's audit of IRS's fiscal year 2010 financial statements, it reviewed IRS's A-123 test plans and verified that they encompassed appropriate consideration of the design of control. Also, GAO reviewed work papers documenting IRS's OMB A-123 work on the design of its internal control for fiscal year 2010, and found that for all transactions IRS tested, it appropriately considered the design of internal control as directed in its respective test plans.
Internal Revenue Service To assist IRS in strengthening its implementation of A-123 reviews in future years, IRS should work with Treasury to identify laws and regulations that are significant to financial reporting, test controls over compliance with those laws and regulations, and evaluate and report on the results of such control reviews.
Closed - Implemented
In fiscal year 2008, GAO verified that IRS identified, planned and conducted appropriate tests of internal controls over compliance with laws and regulations that are significant to financial reporting.
Internal Revenue Service To assist IRS in strengthening its implementation of A-123 reviews in future years, IRS should begin devising appropriate A-123 follow-up procedures for the last 3 months of the fiscal year to be implemented once the material weaknesses identified through the annual financial statement audits have been resolved.
Closed - Implemented
During GAO's audit of IRS's fiscal year 2009 financial statements, it verified that IRS began to devise appropriate follow-up procedures for the last 3 months of the fiscal year. GAO obtained and reviewed IRS's testing plans and determined the procedures to be effective.
Internal Revenue Service To assist IRS in strengthening its implementation of A-123 reviews in future years, IRS should provide A-123 review staff appropriate training, such as that available for financial auditors, to enhance their skills in workpaper documentation, identification and testing of internal controls, and evaluation and documentation of results.
Closed - Implemented
In fiscal year 2008, GAO verified that IRS developed and conducted an appropriate annual training workshop designed to ensure that their A-123 review staff enhance their skills in work paper documentation, identification and testing of internal controls, and evaluation and documentation of test results.

Full Report