Recommendation: To help strengthen information security controls over key financial and tax processing systems, and to more effectively implement security-related policies and plans, the Commissioner of Internal Revenue, in addition to addressing previously made but still unresolved recommendations from our prior audits, should implement the audit plans for the 12 systems and applications that we reviewed in the production computing environment.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: During GAO's audit of FY 2019 IRS financial statements, IRS did not submit this recommendation for closure, but the agency provided some evidence of its progress in implementing this recommendation. When IRS fully implements this recommendation, we will review relevant IRS actions.

Recommendation: To help strengthen information security controls over key financial and tax processing systems, and to more effectively implement security-related policies and plans, the Commissioner of Internal Revenue, in addition to addressing previously made but still unresolved recommendations from our prior audits, should ensure that system administrators and security operations analysts are alerted in the event of audit processing failures.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: During GAO's audit of FY 2019 IRS financial statements, IRS did not submit this recommendation for closure, nor did the agency provide evidence that it had implemented this recommendation. When IRS indicates that it has implemented this recommendation, we will review relevant IRS actions.

Recommendation: To help strengthen information security controls over key financial and tax processing systems, and to more effectively implement security-related policies and plans, the Commissioner of Internal Revenue, in addition to addressing previously made but still unresolved recommendations from our prior audits, should regularly update configuration standards and guidelines for network devices to incorporate recommendations from industry leaders, security agencies, and key practices from IRS partners to address known vulnerabilities applicable to IRS's environment.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: During GAO's audit of FY 2019 IRS financial statements, IRS did not submit this recommendation for closure, nor did the agency provide evidence that it had implemented this recommendation. When IRS indicates that it has implemented this recommendation, we will review relevant IRS actions.

Recommendation: To help strengthen information security controls over key financial and tax processing systems, and to more effectively implement security-related policies and plans, the Commissioner of Internal Revenue, in addition to addressing previously made but still unresolved recommendations from our prior audits, should implement a compliance verification application, or other appropriate process, to ensure configuration policies are comprehensively tested on the mainframe.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: During GAO's audit of FY 2019 IRS financial statements, IRS did not submit this recommendation for closure, nor did the agency provide evidence that it had implemented this recommendation. When IRS indicates that it has implemented this recommendation, we will review relevant IRS actions.

Recommendation: To help strengthen information security controls over key financial and tax processing systems, and to more effectively implement security-related policies and plans, the Commissioner of Internal Revenue, in addition to addressing previously made but still unresolved recommendations from our prior audits, should identify and review service organizations' listing of user controls that are deemed relevant and test those controls to appropriately draw conclusions about the operating effectiveness of controls.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: During GAO's audit of FY 2019 IRS financial statements, IRS did not submit this recommendation for closure, nor did the agency provide evidence that it had implemented this recommendation. When IRS indicates that it has implemented this recommendation, we will review relevant IRS actions.

Recommendation: To help IRS improve its process for determining IT funding priorities and to provide timely information on the progress of its investments, the Commissioner of IRS should direct the Chief Technology Officer to establish, document, and implement policies and procedures for selecting new and reselecting ongoing business systems modernization activities, consistent with IRS's process for prioritizing operations support priorities, which addresses (1) prioritization and comparison of IT assets against each other, (2) criteria for making selection and prioritization decisions, and (3) ensuring IRS executives' final funding decisions on IT proposals are based on IRS's prioritization process.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: In September 2018, IRS provided GAO a slide deck titled "Prioritization Process for the Business Systems Modernization (BSM) Program/Projects" which describes a process for prioritizing BSM investments and capabilities within the investments. However, the slides were labeled "pre-decisional." In addition, they did not include specific procedures for prioritizing investments. In April 2020, IRS informed us that it had moved its target for fully implementing the recommendation to November 2020. We will continue to monitor IRS's efforts to implement the recommendation.

Recommendation: To help IRS improve its process for determining IT funding priorities and to provide timely information on the progress of its investments, the Commissioner of IRS should direct the Chief Technology Officer to modify existing processes for Foreign Account Tax Compliance Act (FATCA) and Return Review Program (RRP) for measuring work performed by IRS staff to incorporate best practices, including accounting for actual work performed and using the level of effort measure sparingly.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: In May 2018, IRS told GAO it had implemented the recommendation. As supporting evidence, the agency provided an April 2018 update to its Investment Performance Tool user guide along with briefing slides specifying actions taken to modify its processes to measure work performed by IRS staff. We reviewed the evidence provided and determined that it was not sufficient to close the recommendation as implemented. Specifically, while the Investment Performance Tool user guide included updated procedures for measuring work performed by IRS staff which aligned with best practices, it did not clearly state that earned value (or work performed) during an iteration should always be based on to the percentage of planned features or user stories that were completed for that iteration. In addition, IRS did not provide evidence that it had used its updated procedures for the Return Review Program investment. We followed up with IRS to obtain this documentation. The agency subsequently provided the requested documentation to us and, as of July 2020, we were reviewing it to determine the extent to which it addresses the recommendation.

Recommendation: The IRS Commissioner should direct the appropriate IRS officials to determine the reason(s) why staff did not always comply with IRS's established policies and procedures related to initiating, monitoring, and reviewing the monitoring of manual refunds and, based on this determination, establish a process to better enforce compliance with these requirements.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: During fiscal year 2019, we identified instances where staff did not comply with IRS's policies and procedures related to monitoring and reviewing the monitoring of manual refunds. IRS officials stated that the Wage and Investment (W&I) organization determined that a fully automated process to perform monitoring of manual refunds is the optimal solution to address, at an enterprise level, deficiencies associated with reliance on employees to monitor refunds in process and take appropriate action when potential duplicate or erroneous refund conditions are encountered. In addition, IRS officials indicated that the W&I organization will develop business requirements and request programming through the Unified Work Request process; however, limited resources and competing priorities prevent the identification of an implementation date. As a result, IRS will place this recommendation on hold until an implementation date is known.

Recommendation: The IRS Commissioner should direct the appropriate IRS officials to identify the cause of and implement a solution for dealing with the periodic backlogs of ICO inventory that is hampering the performance of quality reviews.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: During fiscal year 2019, the Wage and Investment (W&I) organization determined that periodic backlogs of Input Correction Operation (ICO) inventory were caused by a combination of factors, such as systemic issues, fluctuations in projected filings, and hiring challenges. IRS officials stated that the W&I organization has also identified and implemented several strategies to address ICO backlogs and mitigate the impact on the quality review program, including hiring more staff in ICO functions, using seasonal employees, cross-training, overtime, transferring of work, and updating the Internal Revenue Manual. Since IRS provided us with this information near the end of our fiscal year 2019 audit in September 2019, we will evaluate IRS's actions to address this recommendation during our fiscal year 2020 audit.

Recommendation: The IRS Commissioner should direct the appropriate officials to establish and implement monitoring procedures designed to reasonably assure that the key detailed information for tangible capitalized P&E is properly recorded and updated in the KISAM system.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS established the Asset Management Program Monitoring and Review procedure, effective October 1, 2016, for performing quarterly sample reviews of Information Technology (IT) assets in the Knowledge, Incident/Problem, Service Asset Management (KISAM) system. In September 2017, IRS also revised the Internal Revenue Manual to require Facilities Management and Security Services territory managers or section chiefs to review KISAM key data elements for non-IT assets to verify that they are correct and updated. However, during our fiscal year 2018 floor-to-book inventory testing, we identified exceptions where (1) a key detailed information element (e.g., building code) for property and equipment (P&E) assets was not properly recorded in KISAM and (2) P&E assets found on the floor did not have asset records in KISAM. We will conduct inventory testing and follow-up to determine the status of this issue during our audit of IRS's fiscal year 2020 financial statements.

Recommendation: In addition to implementing our previous recommendations, to more effectively implement security-related policies and plans, the Commissioner of Internal Revenue should update system and application audit plans based on the current version of referenced policies and guidelines and when significant changes are made to a system or application.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: During GAO's audit of IRS' FY 2019 financial statements, IRS indicated that it had not yet implemented this recommendation. When the agency indicates that it has implemented this recommendation, we will review its actions.

Recommendation: To improve performance management of taxpayer services, the Secretary of the Treasury should update the Department's performance plan to include overage rates for handling taxpayer correspondence as a part of Treasury's performance goals.

Agency: Department of the Treasury
Status: Open

Comments: In May 2017, Treasury officials told us that they planned to include correspondence data as part of Treasury's fiscal year 2018 annual performance plan and fiscal year 2016 annual performance report. While the fiscal year 2016 performance report included data on correspondence overage rates, as of August 2019, Treasury has not included correspondence overage as part of its performance goals. We continue to believe this recommendation is valid.

Recommendation: In addition to implementing our previous recommendations, to effectively implement key elements of the IRS information security program, the Commissioner of Internal Revenue should ensure that control testing methodology and results fully meet the intent of the control objectives being tested.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open
Priority recommendation

Comments: During our audit of IRS's FY 2019 financial statements, , the agency submitted this recommendation for closure, but our testing determined it should remain open. Subsequently, IRS updated its anticipated closure date for the recommendation to July 2020. As part of our FY 2020 audit, we will continue to monitor IRS's progress in ensuring that its control testing methodology and results fully meet the intent of the control objectives being tested.

Recommendation: In addition to implementing our previous recommendations, to effectively implement key elements of the IRS information security program, the Commissioner of Internal Revenue should update the remedial action verification process to ensure actions are fully implemented.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open
Priority recommendation

Comments: During the audit of IRS's FY 2019 financial statements, the agency submitted this recommendation for closure, but our testing determined that it should remain open. While IRS continued to make positive steps to address our recommendation, the agency's implementation of corrective actions did not fully address it. As part of our FY 2020 audit, we will continue to monitor IRS's progress in strengthening its remedial action verification process and ensuring its corrective actions are fully implemented.

Recommendation: To improve the reliability and reporting of investment performance information and management of selected major investments, the Commissioner of the IRS should direct the Chief Technology Officer to modify reporting of the Affordable Care Act Administration testing status to senior management to include a comprehensive report on all impacted systems--including an explanation for why impacted systems were not tested at a particular level--and ensure this reporting is aligned with the manner in which testing is being performed.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS disagreed with this recommendation at the time we made it stating that it followed a rigorous risk-based process for planning the tests of ACA-impacted systems, including the types and levels of testing, and that it had comprehensive reporting for the filing season 2015 release, which included ACA impacted systems. However, as noted in our report, our review of ACA Testing Review Checkpoint reports and filing season reports, which officials stated were used to provide comprehensive reports to senior managers, did not identify the status of testing for all systems impacted by ACA Releases 5.0 and 6.0. In September 2017, IRS finished developing ACA and the investment transitioned to the operations and maintenance phase. We followed up with IRS to determine the extent to which it might be implementing the recommendation in light of this transition. In response, in June and December 2019 , IRS provided some documentation, including systems acceptance test plans and end-of-test results reports for ACA releases completed since September 2017. We reviewed the documentation provided and determined that it did not provide a status of testing for all systems impacted as we recommended. As of September 2020, we were following up with IRS to determine if the agency has other documentation provided to senior managers that addresses our recommendation.

Recommendation: While IRS works to improve the quality of its Schedule K-1 data, the Commissioner of Internal Revenue should develop a plan for conducting testing or other analysis to determine whether the improved Schedule K-1 data, perhaps combined with other IRS information about businesses and taxpayers, could be used more effectively to ensure compliance with the reporting of flow-through income.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS stated that it understands the objective of this recommendation and, at such time that resources are available to enhance capabilities, it would consider the proposed methodology of advanced testing. However, based on current and anticipated budget constraints, it does not expect its plans to change in the near future. As of September 2020, there has been no change. As such we will continue to monitor progress.

Recommendation: The Acting Commissioner of Internal Revenue should direct the appropriate IRS officials to perform a risk assessment to determine the appropriate level of Integrated Data Retrieval System (IDRS) access that should be granted to employee groups that handle hard-copy taxpayer receipts and related sensitive taxpayer information as part of their job responsibilities.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS's actions to address this recommendation are ongoing. In October 2019, the functions within the Small Business/Self-Employed organization completed risk assessments to determine the appropriate level of Integrated Data Retrieval System (IDRS) access that should be granted to the employees who handle hard-copy taxpayer receipts and related sensitive taxpayer information as part of their job responsibilities. In addition, IRS officials stated that during fiscal year 2020, the Taxpayer Advocate Service organization, in coordination with the Information Technology organization, as necessary, will complete a risk assessment of all employee groups that handle hard-copy taxpayer receipts and related sensitive taxpayer information to determine the most appropriate level of IDRS access.

Recommendation: The Acting Commissioner of Internal Revenue should direct the appropriate IRS officials to, based on the results of the risk assessment, update the Internal Revenue Manual (IRM) accordingly to specify the appropriate level of IDRS access that should be allowed for (1) remittance perfection technicians and (2) all other employee groups with IDRS access that handle hard-copy taxpayer receipts and related sensitive information as part of their job responsibilities.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS's actions to address this recommendation are ongoing. IRS officials stated that by October 2020, the Small Business/Self-Employed, Taxpayer Advocate Service, and Tax Exempt & Government Entities organizations will work with the Information Technology organization, as necessary, to ensure that the applicable Internal Revenue Manual section(s) are revised for any policy changes on (1) risk mitigation, including specifying the appropriate level of Integrated Data Retrieval System access that should be allowed and (2) risk acceptance for affected employee groups, as needed.

Recommendation: The Acting Commissioner of Internal Revenue should direct the appropriate IRS officials to establish procedures to implement the updated IRM, including required steps to follow to prevent (1) remittance perfection technicians and (2) all other employee groups that handle hard-copy taxpayer receipts and related sensitive information as part of their job responsibilities from gaining access to command codes not required as part of their designated job duties.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS's actions to address this recommendation are ongoing. IRS officials stated that by October 2020, the Small Business/Self-Employed, Taxpayer Advocate Service, and Tax Exempt & Government Entities organizations will work with the Information Technology organization, as necessary, to establish procedures to prevent affected employees from gaining access to command codes not required as part of their designated job duties, as needed.

Recommendation: Congress may wish to consider instituting a penalty on non-material advisor promoters for failing to provide investor lists to IRS within a specified time period when requested, comparable to the 20-business-day requirement for material advisors.

Agency: Congress
Status: Open

Comments: As of February 2020, we have not identified legislative action in the 114th or 115th Congress or any enacted legislation since 2011 amending section 6111 (disclosure of reportable transactions including the definition of a material advisor), section 6112 (requirement to keep lists of investors) or section 6708 (imposing the penalty for failure to maintain and provide lists to IRS).

Recommendation: To improve reporting on the results of examinations on ATAT issues, the Commissioner of Internal Revenue should separately track the tax amounts recommended, assessed, and collected between ATAT issues and non-ATAT issues.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: As of December 2019, IRS did not plan on taking any further actions to track examination results for ATAT versus non-ATAT issues, as GAO recommended in May 2011. In July 2012, IRS told GAO that although it agreed with GAO's May 2011 recommendation, resource and capability constraints preclude it from capturing information in this way. GAO maintains that tracking examination results for ATAT versus non-ATAT issues would provide IRS management with the data needed to make informed judgments about program effectiveness and resource allocations. IRS has taken steps to check whether taxpayers file all required ATAT-related disclosure obligations. In February 2013, IRS implemented a new indicator and matching process to regularly review whether taxpayers are meeting their ATAT-related filing obligations. Additionally, IRS developed a procedure to evaluate the completeness of ATAT-related disclosure forms and follow up on incomplete forms as necessary and updated the Internal Revenue Manual to reflect these changes. Developing and implementing these new processes and procedures will provide IRS with additional information for determining whether the disclosures are made as required and are complete.

Recommendation: To ensure that IRS can adequately enforce certain tax provisions, Congress may wish to consider providing IRS with MEA to use tax return information from previous years to ensure that taxpayers do not improperly claim credits or deductions in excess of lifetime limits where applicable.

Agency: Congress
Status: Open

Comments: As of March 2020, Congress has expanded IRS's math error authority in certain circumstances, but not as broadly as GAO suggested in February 2010. Section 208 of division Q of the Consolidated Appropriations Act, 2016 (Public Law 114-113 enacted in December 2015) gave IRS the authority to use math error authority if (1) a taxpayer claimed the Earned Income Tax Credit, Child Tax Credit, or the American Opportunity Tax Credit (AOTC) during the period in which a taxpayer is not permitted to claim such credit as a consequence of either having made a prior fraudulent or reckless claim; or (2) a taxpayer omitted information required to be reported because the taxpayer made prior improper claims of the Child Tax Credit or the AOTC. While expanding math error authority is consistent with what GAO suggested in February 2010, GAO maintains that a broader authorization of math error authority with appropriate controls would enable IRS to correct obvious noncompliance, would be less intrusive and burdensome to taxpayers than audits, and would potentially help taxpayers who underclaim tax benefits to which they are entitled. If Congress decides to extend broader math error authority to IRS, controls may be needed to ensure that this authority is used properly such as requiring IRS to report on its use of math error authority. The Administration also requested that Congress expand IRS's math error authority as part of the Service's Congressional Budget Justification and Annual Performance Report and Plan for fiscal year 2021. Specifically, the Administration requested authority to correct a taxpayer's return in the following circumstances: 1) the information provided by the taxpayer does not match the information contained in government databases or Form W-2, or from other third party databases as the Secretary determines by regulation; 2) the taxpayer has exceeded the lifetime limit for claiming a deduction or credit; or 3) the taxpayer failed to include with his or her return certain documentation that is required to be included on or attached to the return. As of March 2020, the Congress had not provided IRS with such authority.

Recommendation: Given the potential for improving compliance now and in the future, Congress may wish to provide IRS with the authority to use math error checks to identify and correct returns with ineligible (1) IRA "catch-up" contributions, and (2) contributions to traditional IRAs from taxpayers over age 70-1/2.

Agency: Congress
Status: Open

Comments: As of March 2020, Congress has expanded IRS's math error authority in certain circumstances, but not as broadly as GAO suggested in February 2010. Section 208 of division Q of the Consolidated Appropriations Act, 2016 (Public Law 114-113 enacted in December 2015) gave IRS the authority to use math error authority if (1) a taxpayer claimed the Earned Income Tax Credit, Child Tax Credit, or the American Opportunity Tax Credit (AOTC) during the period in which a taxpayer is not permitted to claim such credit as a consequence of either having made a prior fraudulent or reckless claim; or (2) a taxpayer omitted information required to be reported because the taxpayer made prior improper claims of the Child Tax Credit or the AOTC. While expanding math error authority is consistent with what GAO suggested in February 2010, GAO maintains that a broader authorization of math error authority with appropriate controls would enable IRS to correct obvious noncompliance, would be less intrusive and burdensome to taxpayers than audits, and would potentially help taxpayers who underclaim tax benefits to which they are entitled. If Congress decides to extend broader math error authority to IRS, controls may be needed to ensure that this authority is used properly such as requiring IRS to report on its use of math error authority. The Administration also requested that Congress expand IRS's math error authority as part of the Service's Congressional Budget Justification and Annual Performance Report and Plan for fiscal year 2019. Specifically, the Administration requested authority to correct a taxpayer's return in the following circumstances: 1) the information provided by the taxpayer does not match the information contained in government databases; 2) the taxpayer has exceeded the lifetime limit for claiming a deduction or credit; or 3) the taxpayer has failed to include with his or her return certain documentation that is required by statute. As of April 2019, the Congress had not provided IRS with such authority.