Recommendation: To help strengthen information security controls over key financial and tax processing systems, and to more effectively implement security-related policies and plans, the Commissioner of Internal Revenue, in addition to addressing previously made but still unresolved recommendations from our prior audits, should implement the audit plans for the 12 systems and applications that we reviewed in the production computing environment.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: During GAO's audit of FY 2019 IRS financial statements, IRS did not submit this recommendation for closure, but the agency provided some evidence of its progress in implementing this recommendation. When IRS fully implements this recommendation, we will review relevant IRS actions.

Recommendation: To help strengthen information security controls over key financial and tax processing systems, and to more effectively implement security-related policies and plans, the Commissioner of Internal Revenue, in addition to addressing previously made but still unresolved recommendations from our prior audits, should ensure that system administrators and security operations analysts are alerted in the event of audit processing failures.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: During GAO's audit of FY 2019 IRS financial statements, IRS did not submit this recommendation for closure, nor did the agency provide evidence that it had implemented this recommendation. When IRS indicates that it has implemented this recommendation, we will review relevant IRS actions.

Recommendation: To help strengthen information security controls over key financial and tax processing systems, and to more effectively implement security-related policies and plans, the Commissioner of Internal Revenue, in addition to addressing previously made but still unresolved recommendations from our prior audits, should regularly update configuration standards and guidelines for network devices to incorporate recommendations from industry leaders, security agencies, and key practices from IRS partners to address known vulnerabilities applicable to IRS's environment.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: During GAO's audit of FY 2019 IRS financial statements, IRS did not submit this recommendation for closure, nor did the agency provide evidence that it had implemented this recommendation. When IRS indicates that it has implemented this recommendation, we will review relevant IRS actions.

Recommendation: To help strengthen information security controls over key financial and tax processing systems, and to more effectively implement security-related policies and plans, the Commissioner of Internal Revenue, in addition to addressing previously made but still unresolved recommendations from our prior audits, should implement a compliance verification application, or other appropriate process, to ensure configuration policies are comprehensively tested on the mainframe.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: During GAO's audit of FY 2019 IRS financial statements, IRS did not submit this recommendation for closure, nor did the agency provide evidence that it had implemented this recommendation. When IRS indicates that it has implemented this recommendation, we will review relevant IRS actions.

Recommendation: To help strengthen information security controls over key financial and tax processing systems, and to more effectively implement security-related policies and plans, the Commissioner of Internal Revenue, in addition to addressing previously made but still unresolved recommendations from our prior audits, should identify and review service organizations' listing of user controls that are deemed relevant and test those controls to appropriately draw conclusions about the operating effectiveness of controls.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: During GAO's audit of FY 2019 IRS financial statements, IRS did not submit this recommendation for closure, nor did the agency provide evidence that it had implemented this recommendation. When IRS indicates that it has implemented this recommendation, we will review relevant IRS actions.

Recommendation: In addition to implementing our previous recommendations, to more effectively implement security-related policies and plans, the Commissioner of Internal Revenue should update system and application audit plans based on the current version of referenced policies and guidelines and when significant changes are made to a system or application.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: During GAO's audit of IRS' FY 2019 financial statements, IRS indicated that it had not yet implemented this recommendation. When the agency indicates that it has implemented this recommendation, we will review its actions.

Recommendation: The Commissioner of Internal Revenue should direct the referral programs to establish a mechanism to coordinate on a plan and timeline for developing a consolidated, online referral submission in order to better position IRS to leverage specialized expertise while exploring options to further consolidate the initial screening operations.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open
Priority recommendation

Comments: As of January 2020, IRS had taken some action to establish a mechanism to coordinate on a plan and timeline for developing a consolidated, online referral submission, as GAO recommended in its February 2016 report. IRS established a cross-functional team in February 2016 to comprehensively review IRS's referral programs. Among other things, the team has explored options to consolidate the initial screening operations and determine the scope and complexity for moving the referral process to an online format. According to IRS, an electronic submission process is expected to provide better access to the program and reduce the burden associated with making a written report or referral. In November 2016, the cross-functional team requested information technology resources for fiscal year 2019 to develop an online system which could potentially replace four separate referral forms, filter out incomplete referrals, and electronically route referrals for further IRS action. IRS assessed options for consolidating all forms for the various referral programs and determined that consolidating them to a single form was not feasible because of the technical nature and complexity of the various referral types. The cross-functional team had worked with IRS On Line Services to develop an online application prototype and was considering the cost-effectiveness of a commercial off-the-shelf product. According to IRS, the online application will make it easier for the public to report possible tax violations. Also, the online system will improve efficiency in coordination and provide reports that will be incorporated into the quarterly coordination meetings of the new cross-division referral coordination committee. As of January 2020, IRS was still considering funding for online referral submission development. IRS estimated that a commercial off-the-shelf product would cost about $2 million with an online referral capacity operational within one year. IRS said it will consider further consolidating the referral programs once the online application is in place. Without continued progress on efforts to consolidate referral intake, IRS faces continued inefficiencies in receiving and processing referrals as well as public confusion caused by trying to choose among multiple forms.

Recommendation: To strengthen oversight of the individual shared responsibility and premium tax credit provisions, the Commissioner of Internal Revenue should assess whether or not the data received from the health insurance marketplaces are sufficiently complete and accurate to enable effective correction of tax returns at-filing based on matching with the marketplace data and, if the assessment determines that such corrections would be effective, seek legislative authority to correct tax returns at-filing based on the marketplace data.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: The Internal Revenue Service (IRS) agreed with GAO's recommendation. IRS reports that the quality of data submitted by health insurance marketplaces has improved since the 2015 return filing season, and it continues to use its correspondence process for resolving discrepancies between marketplace data and that reported by the taxpayer after the return has been filed. IRS has not considered requesting legislative authority to correct tax returns at the time of filing based specifically on discrepancies between the data submitted by the health insurance marketplace and reported by the taxpayer. Agency officials believe that would be premature at this time. They noted that a broader legislative initiative has already been proposed that would grant IRS with correctable error authority in cases where the information provided by the taxpayer does not match the information contained in government databases. Should this broad authority be granted in the future, IRS will then consider how to approach correction of tax returns at the time of filing based on discrepancies with health insurance marketplace data. Such authority was also included in the Administration's 2021 budget.

Recommendation: To strengthen oversight of the individual shared responsibility and premium tax credit provisions, the Commissioner of Internal Revenue should evaluate IRS efforts to collaborate and communicate with key external stakeholders to inform efforts related to implementation of the new 2015 PPACA requirements.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: The Internal Revenue Service (IRS) agreed with GAO's recommendation but has not yet initiated an evaluation of collaboration and communication efforts with external stakeholders. IRS currently utilizes informal feedback processes to share information and identify opportunities for improvement with external stakeholders in implementing the shared responsibility payment and premium tax credit provisions. We continue to encourage IRS to evaluate its collaboration and communication efforts, but such an evaluation has not yet happened. We will continue to monitor IRS efforts.

Recommendation: In addition to implementing our previous recommendations, to effectively implement key elements of the IRS information security program, the Commissioner of Internal Revenue should ensure that control testing methodology and results fully meet the intent of the control objectives being tested.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open
Priority recommendation

Comments: During our audit of IRS's FY 2019 financial statements, , the agency submitted this recommendation for closure, but our testing determined it should remain open. Subsequently, IRS updated its anticipated closure date for the recommendation to July 2020. As part of our FY 2020 audit, we will continue to monitor IRS's progress in ensuring that its control testing methodology and results fully meet the intent of the control objectives being tested.

Recommendation: In addition to implementing our previous recommendations, to effectively implement key elements of the IRS information security program, the Commissioner of Internal Revenue should update the remedial action verification process to ensure actions are fully implemented.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open
Priority recommendation

Comments: During the audit of IRS's FY 2019 financial statements, the agency submitted this recommendation for closure, but our testing determined that it should remain open. While IRS continued to make positive steps to address our recommendation, the agency's implementation of corrective actions did not fully address it. As part of our FY 2020 audit, we will continue to monitor IRS's progress in strengthening its remedial action verification process and ensuring its corrective actions are fully implemented.

Recommendation: The Acting Commissioner of Internal Revenue should direct the appropriate IRS officials to perform a risk assessment to determine the appropriate level of Integrated Data Retrieval System (IDRS) access that should be granted to employee groups that handle hard-copy taxpayer receipts and related sensitive taxpayer information as part of their job responsibilities.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS's actions to address this recommendation are ongoing. In October 2019, the functions within the Small Business/Self-Employed organization completed risk assessments to determine the appropriate level of Integrated Data Retrieval System (IDRS) access that should be granted to the employees who handle hard-copy taxpayer receipts and related sensitive taxpayer information as part of their job responsibilities. In addition, IRS officials stated that during fiscal year 2020, the Taxpayer Advocate Service organization, in coordination with the Information Technology organization, as necessary, will complete a risk assessment of all employee groups that handle hard-copy taxpayer receipts and related sensitive taxpayer information to determine the most appropriate level of IDRS access.

Recommendation: The Acting Commissioner of Internal Revenue should direct the appropriate IRS officials to, based on the results of the risk assessment, update the Internal Revenue Manual (IRM) accordingly to specify the appropriate level of IDRS access that should be allowed for (1) remittance perfection technicians and (2) all other employee groups with IDRS access that handle hard-copy taxpayer receipts and related sensitive information as part of their job responsibilities.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS's actions to address this recommendation are ongoing. IRS officials stated that by October 2020, the Small Business/Self-Employed, Taxpayer Advocate Service, and Tax Exempt & Government Entities organizations will work with the Information Technology organization, as necessary, to ensure that the applicable Internal Revenue Manual section(s) are revised for any policy changes on (1) risk mitigation, including specifying the appropriate level of Integrated Data Retrieval System access that should be allowed and (2) risk acceptance for affected employee groups, as needed.

Recommendation: The Acting Commissioner of Internal Revenue should direct the appropriate IRS officials to establish procedures to implement the updated IRM, including required steps to follow to prevent (1) remittance perfection technicians and (2) all other employee groups that handle hard-copy taxpayer receipts and related sensitive information as part of their job responsibilities from gaining access to command codes not required as part of their designated job duties.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS's actions to address this recommendation are ongoing. IRS officials stated that by October 2020, the Small Business/Self-Employed, Taxpayer Advocate Service, and Tax Exempt & Government Entities organizations will work with the Information Technology organization, as necessary, to establish procedures to prevent affected employees from gaining access to command codes not required as part of their designated job duties, as needed.

Recommendation: The Commissioner of the IRS should direct the appropriate IRS officials to revise the post orders for the service center campuses (SCC) and lockbox bank security guards to include specific procedures for timely reporting exterior lighting outages to SCC or lockbox bank facilities management. These procedures should specify (1) whom to contact to report lighting outages and (2) how to document and track lighting outages until resolved.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS's actions to address this recommendation are ongoing. IRS officials stated that during fiscal year 2020, Facilities Management and Security Services (FMSS) will update the Internal Revenue Manual to reflect the necessary guidance for service center guards and FMSS physical security specialists to know (1) whom the guards are to contact to report lighting outages and (2) how lighting outages are to be documented and tracked until resolved.