Information Technology: IRS Needs to Complete Modernization Plans and Fully Address Cloud Computing Requirements
Fast Facts
The IRS relies extensively on its IT systems to collect taxes and distribute refunds. However, much of its IT infrastructure is outdated, which can increase cybersecurity risks, staffing issues, and costs.
As of August 2022, the IRS had 21 modernization initiatives, including 9 to replace its outdated IT systems. However, 6 of those 9 initiatives did not specify how they would dispose of outdated systems—a key element in IT modernization. Officials stated they would address this element at the appropriate time.
We made 9 recommendations to the IRS, including that it establish time frames to complete its IT modernization plans.
Highlights
What GAO Found
The Internal Revenue Service's (IRS) legacy IT environment includes applications, software, and hardware, which are outdated but still critical to day-to-day operations. Specifically, GAO's analysis showed that about 33 percent of the applications, 23 percent of the software instances in use, and 8 percent of hardware assets were considered legacy. This includes applications ranging from 25 to 64 years in age, as well as software up to 15 versions behind the current version. As GAO has previously noted, and IRS has acknowledged, these legacy assets will continue to contribute to security risks, unmet mission needs, staffing issues, and increased costs.
Modernization best practices call for documenting plans that include three key elements: milestones, work to be performed, and disposition of legacy systems. As of August 2022, IRS had documented plans for the 21 modernization initiatives that were underway, including nine associated with legacy systems. All 21 plans addressed two key elements. However, the plans for six of the nine initiatives did not address the disposition of legacy systems (see table). Officials stated they would address this key element at the appropriate time in the initiatives' lifecycle; however, they did not identify time frames for doing so.
GAO Assessment of the Internal Revenue Service's (IRS) Modernization Plans as of August 2022
|
Modernization plan element |
Yes |
No |
Not applicable |
|---|---|---|---|
|
Includes milestones |
21 |
0 |
0 |
|
Describes work to be performed |
21 |
0 |
0 |
|
Includes disposition of legacy systems |
3 |
6 |
12a |
Source: GAO analysis of IRS documents. | GAO-23-104719
aThese initiatives were not associated with legacy systems.
IRS recently suspended operations of six initiatives, including two which are essential to replacing the 60-year old Individual Master File (IMF). The IMF is the authoritative data source for individual tax account data. GAO has reported that IRS has been working to replace IMF for well over a decade. According to officials, the suspensions were due to IRS's determination to shift resources to higher priorities; staff members working on these suspended initiatives were reassigned to other projects. As a result, the schedule for these initiatives is now undetermined. Accordingly, the 2030 target completion date for replacing the IMF that IRS announced last year is now unknown. This will lead to mounting challenges in continuing to rely on a critical system with software written in an archaic language requiring specialized skills.
IRS's cloud computing efforts fully addressed 11, partially addressed one, and did not address two requirements identified in the Office of Management and Budget's June 2019 cloud computing strategy. Key shortfalls include IRS not conducting regular evaluations of customer experiences and user needs. Until IRS fully addresses all cloud computing requirements, it will have less assurance that it is adopting cloud solutions that efficiently and effectively help it meet its mission needs and protect sensitive taxpayer information.
Why GAO Did This Study
IRS relies extensively on IT to annually collect trillions of dollars in taxes, distribute hundreds of billions of dollars in refunds, and carry out its mission of providing service to America's taxpayers in meeting their tax obligations. This reliance on IT includes a significant amount of outdated legacy systems that pose risks. At the same time, IRS has increasingly used internet-based computing services (i.e., cloud services) to address its IT modernization needs.
GAO was asked to review IRS's legacy environment and cloud computing implementation. This report, among other things, 1) describes IRS's legacy IT environment; 2) assesses IRS's modernization plans; and 3) evaluates its cloud computing efforts.
To do so, GAO analyzed legacy applications, software, and hardware data; assessed plans for 21 modernization initiatives against practices identified in prior GAO work; and compared IRS's cloud computing documentation to relevant federal requirements. GAO also interviewed knowledgeable IRS officials.
Recommendations
GAO is making nine recommendations to IRS, including that it establish time frames to complete selected modernization plans, and fully address OMB's cloud computing requirements. IRS agreed with all nine recommendations.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Internal Revenue Service | The Commissioner of the IRS should ensure that IRS establishes time frames for addressing the disposition of legacy systems for the Enterprise Case Management modernization initiative and follow through to document a complete modernization plan. (Recommendation 1) |
In March 2025, IRS officials stated that all legacy system users were successfully transitioned to the new ECM application. They also stated that they had developed a final migration report, including disposition of legacy systems, and were working to receive final approval of the report for a planned retirement date of June 30, 2026. However, in May 2025, IRS officials stated that the agency was reevaluating its IT modernization investments and priorities. We will follow-up on the status of the reevaluation efforts and determine the extent to which they affect IRS's actions to address this recommendation.
|
| Internal Revenue Service | The Commissioner of the IRS should ensure that IRS establishes time frames for addressing the disposition of legacy systems for the Enterprise Data Platform modernization initiative and follow through to document a complete modernization plan. (Recommendation 2) |
In July 2024, IRS provided a roadmap that identified timeframes for decommissioning the different legacy system's capabilities and milestones within the Enterprise Data Platform from fiscal year 2024 to 2026. In addition, the document identified how the agency plans to integrate the legacy decommissioning roadmap into IRS's enterprise architecture and roadmap. However, in May 2025, IRS officials stated that the agency was reevaluating its IT modernization investments and priorities. We will follow-up on the status of the reevaluation efforts and determine the extent to which they affect IRS's actions to address this recommendation.
|
| Internal Revenue Service | The Commissioner of the IRS should ensure that IRS establishes time frames for addressing the disposition of legacy systems for the Information Returns Modernization initiative and follow through to document a complete modernization plan. (Recommendation 3) |
In February 2025, IRS provided a modernization plan with milestones and associated tasks for the decommissioning of legacy systems for the Information Returns Modernization (IR Mod). The plan showed that decommissioning is expected to be complete in fiscal year 2027. In May 2025, IRS officials stated that the agency was reevaluating its IT modernization investments and priorities. We will follow-up on the status of the reevaluation efforts and determine the extent to which they affect IRS's actions to address this recommendation.
|
| Internal Revenue Service | The Commissioner of the IRS should ensure that IRS establishes time frames for addressing the disposition of legacy systems for the Information Technology Service Management modernization initiative and follow through to document a complete modernization plan. (Recommendation 4) |
In February 2024, the Information Technology Service Management initiative was renamed to Enterprise Service Management (ESM). In May 2024, IRS provided its decommissioning plan, dated April 2024, that identified high-level activities and milestones for decommissioning all projects under its ESM. In addition, IRS provided its decommissioning tracker that identified a phased approach and detailed information regarding what remains to be done for ESM (ITSM) legacy system decommissioning. Further, IRS provided a decommissioning update, dated May 2024 that identified two of the four milestones for decommission were completed. However, in May 2025, IRS officials stated that the agency was reevaluating its IT modernization investments and priorities. We will follow-up on the status of the reevaluation efforts and determine the extent to which they affect IRS's actions to address this recommendation.
|
| Internal Revenue Service | The Commissioner of the IRS should ensure that IRS establishes time frames for addressing the disposition of legacy systems for the Enterprise Anomaly Detection / Enterprise Case Selection modernization initiative and follow through to document a complete modernization plan when it resumes. (Recommendation 5) |
In February 2025, IRS provided its Solution Architecture plan for Enterprise Case Selection (ECS) / Enterprise Anomaly Detection (EAD), dated September 2024. The document describes IRS's plan to decommission the program, and refers to IRS's ECS/EAD roadmap, which includes milestones for migrating to the modernization program. However, in May 2025, IRS officials stated that the agency was reevaluating its IT modernization investments and priorities. We will follow-up on the status of the reevaluation efforts and determine the extent to which they affect IRS's actions to address this recommendation.
|
| Internal Revenue Service | The Commissioner of the IRS should ensure that IRS establishes time frames for addressing the disposition of legacy systems for the Workforce Infrastructure modernization initiative and follow through to document a complete modernization plan when it resumes. (Recommendation 6) |
In August 2024, IRS stated that it was working to establish timeframes to address the disposition of legacy systems for the Workforce Infrastructure modernization initiative and would develop a plan by June 2025. However, in May 2025, IRS officials stated that the agency was reevaluating its IT modernization investments and priorities. We will follow-up on the status of the reevaluation efforts and determine the extent to which they affect IRS's actions to address this recommendation.
|
| Internal Revenue Service | The Commissioner of the IRS should ensure that IRS's cloud computing efforts fully address the key OMB requirement associated with standardizing cloud contract service level agreements that will provide more effective, efficient, and secure cloud procurement outcomes for agencies. (Recommendation 7) |
In August 2024, IRS provided a listing of service level objectives to be included into cloud contracts. Specifically, the list proposed standardized objectives to include in IRS's cloud contract Service Level Agreements (SLA). In addition, IRS provided a procurement acquisition checklist, dated May 2024 which requires acquisitions that utilize cloud services, to include SLAs as part of the acquisition package. Further, in February 2025, IRS provided an example of a contract that contained SLA language for cloud computing. By implementing this cloud computing requirement, IRS will have greater assurance that it is adopting cloud solutions that efficiently and effectively help to meet its mission needs and protect sensitive taxpayer information.
|
| Internal Revenue Service | The Commissioner of the IRS should ensure that IRS's cloud computing efforts fully address the key OMB requirement associated with developing and implementing policy to contracts impacting high value assets that are managed and operated in the cloud, including requirements that provide continuous visibility of the asset. (Recommendation 8) |
In August 2024, IRS provided its updated IT cloud security policy. The policy, dated February 2024, addressed incorporating requirements into all existing and future contracts and service level agreements that enable the execution of high value assets, including cloud managed services. Further, the policy addressed that all contracts impacting high value assets, including those managed in the cloud, provide IRS with continuous visibility of the asset. In addition, IRS provided multiple cloud service monitoring monthly reports from November 2023 to February 2024 summarizing IRS's cloud security operations, status, and risks. By implementing this cloud computing requirement IRS can have greater assurance that it is adopting cloud solutions that efficiently and effectively help to meet its mission needs and protect sensitive taxpayer information.
|
| Internal Revenue Service | The Commissioner of the IRS should ensure that IRS's cloud computing efforts fully address the key OMB requirement associated with conducting regular evaluations of customer experiences and user needs to ensure that cloud solutions foster efficiency, accessibility, and privacy. (Recommendation 9) |
In August 2024, IRS provided its FY23 Operational Analysis for Major IT Investments, dated April 2024. Specifically, the operational analysis identified that for one investment, Customer Account Data Engine 2, customer satisfaction surpassed target projections, due to faster processing times. For another investment, Web Applications, the performance table identified that customer satisfaction exceeded the targeted projections due to quicker than average application loading times and fewer service outages. However, the operational analysis did not show that customer evaluations were tied to customers' experience using cloud solutions.
|