IRS Lockbox Banks: More Effective Oversight, Stronger Controls, and Further Study of Costs and Benefits are Needed

The Memorandum of Understanding (MOU) between the Financial Management Service (FMS) and IRS detailing the roles and responsibilities of each organization in administering the IRS Lockbox Program, was signed April 30, 2003. In addition, IRM 3.0.230, Lockbox Processing Procedures, and the LPG (2003 and 2004) outline the duties and responsibilities of FMS and IRS. During its audit of IRS's fiscal year 2004 financial statements, GAO confirmed that IRS's MOU was incorporated into an update of the IRM and in the 2004 LPG.

IRS and the Financial Management Service (FMS) prepared a reimbursement process. The procedures include the use of a special Lockbox Program code to delineate IRS rework costs as a result of errors made by the lockbox sites. The Lockbox Policy Reimbursement procedures are included in the 2005 LPG under LPG 2.1.9 and 2005 Lockbox Processing Procedures under IRM 3.0.230.9.3. During its fiscal year 2005 audit, GAO verified that IRS had incorporated reimbursement procedures in the 2005 LPG.

IRS reported that the new waiver process is described in section 2.1.3.1 of the January 2003 LPG document. The Office of Program Evaluation and Risk Analysis documented the internal process between IRS and FMS in the Security Memorandum of Understanding (MOU). During its fiscal year 2003 IRS financial audit, GAO verified that the new waiver process is described in the January 2003 LPG and that the internal process between IRS and FMS is documented in the MOU.

IRS reported that the Security MOU, completed on April 1, 2003, documents the roles and responsibilities of the Security Review Team, which is comprised of FMS and IRS security experts. IRS documents its findings, which are sent to FMS to be included in a final report to the banks. This report covers findings, recommendations, and due dates for all corrective actions. IRS receives a copy of the final report. The IRS's oversight roles and responsibilities can be found in the 2005 Lockbox Processing Guidelines (LPG) under 2.1.2.2, Revenue and Deposit Branch, Lockbox Policy and Procedures (LPP), LPG 2.1.2.3, Revenue and Deposit Branch, Lockbox Field Operations (LFO) and the Lockbox IRM 3.0.230. Specifically, the LPG, which the lockbox banks are required to follow, states that IRS's Tax Payment Management Branch will determine, in conjunction with FMS and Lockbox Field Operations, if actions need to be taken as a result of lockbox performance measures, and that this Branch will update the LPG as needed. During fiscal year 2004, GAO verified that IRS outlined the oversight duties and responsibilities for FMS and IRS in the IRM and in the 2004 LPG. In addition, IRS also documented the oversight roles and responsibilities in the 2005 LPG.

IRS reported that the Memorandum of Understanding (MOU) documents the roles and responsibilities of the Security Review team, which conducts announced and unannounced security reviews. The security review team consists of FMS and IRS security experts. During its fiscal year 2003 IRS financial audit, GAO verified that the roles and responsibilities of the security review team were documented in the MOU.

IRS reported that all lockbox banks underwent security reviews in 2003 and 2004. The banks were required to respond officially to the items identified in the security report. Security reviews were based on the lockbox sites' compliance with the LPG. IRS is represented on the security review team, provides input related to the review to FMS, and then receives a copy of the final response sent by FMS to the lockbox bank. Reviews were submitted to the National Office in a timely manner. Document Collection Instrument (DCI) reviews were examined for completeness and accuracy. During the fiscal year 2004 audit, GAO reviewed the results of IRS and FMS April peak-season security reviews, captured in joint IRS/FMS consolidated trip reports for each lockbox site, and concluded there these reviews were completed and submitted to IRS's National Office in a timely manner.

IRS reported that it updated the security check sheet in January 2004 to instruct reviewers to determine whether contractors have completed and obtained favorable fingerprint results and to review all relevant logs for cash payments and candling logs. In order to ensure compliance to the Lockbox Processing Guideline (LPG) requirements, an IRS and Financial Management Service (FMS) task group developed a performance measures process to include a category for security (Courier, Physical, Remittance) that was implemented in October 2005. This process which was piloted in 2005 and implemented in January 2006 uses a data collection instrument (DCI) check sheet that lists by line item the requirements as outlined in the LPG. It is used as a tool to identify varying levels of performance and provide incentives and disincentives based on those levels of performance. This helps the IRS/FMS Security staff ensure compliance with the LPG requirements. Additionally, an internal control review is included in the reviews performed quarterly by the Lockbox coordinators. During its fiscal year 2005 audit, GAO verified that the lockbox coordinator's on-site review check sheet included the requirement to ensure that the cash and candling logs are being kept and updated daily and that contractors have completed and obtained favorable results on IRS fingerprint checks.

GAO issued this recommendation in January 2003 when the lockbox coordinators were the only individuals responsible for conducting the performance reviews and at that time these reviews were not being performed because of competing demands. Over the years, IRS and Financial Management Service (FMS) have increased their oversight of the lockbox bank program with various performance and compliance reviews. These reviews include peak season trip reports and annual security reviews conducted jointly by IRS and FMS staff. In addition, IRS has implemented a scorecard system performed, reviewed, and signed by both IRS and FMS that incorporates the results of the reviews. GAO has determined that these procedures collectively satisfy the objective of this recommendation.

IRS reported that security teams consisting of individuals from FMS, AWSS, and IRS are responsible for on-site security reviews. Lockbox sites are receiving announced and unannounced security reviews as of November 2002. These reviews monitor management's compliance with this requirement. During its fiscal year 2003 IRS financial audit, GAO verified that IRS had taken steps to monitor compliance with this requirement. Additionally, this item is included in FMS' monitoring/oversight checklist.

IRS reported that the Lockbox Security Guidelines (LSG) is no longer included in the Lockbox Processing Guidelines (LPG) to provide more emphasis on security. Beginning in 2006 LSG is a separate document. LSG 2.2.2.4(7) requires that "Bank management is ultimately responsible for access control and procedures for ensuring only authorized personnel are granted access to the processing floor. Bank management must be involved in the day to day access control process. This responsibility cannot be delegated (e.g. to temporary agency personnel, security guards, third parties)." LSG 2.2.3.1 (7) provides the requirements for guards to respond to alarms. The Security Team performs alarm testing and evaluates guards' responses to alarms during their on-site security reviews. Security Performance Measures (effective January 2006) were developed to measure and rate each site's overall adherence to security guidelines and provides incentives/disincentives accordingly. Mission Assurance and FMS Security staff supports the Lockbox Policy and Procedures Program Office in conducting security reviews. Reviews rate each site's compliance to physical, personnel, courier, and information technology (IT) security. GAO verified that the LSG requires lockbox bank management to ensure that guards are responsive to alarms. Additionally, GAO verified that Security Performance Measures are in place to measure and rate each lockbox bank's overall adherence to security guidelines.

During its fiscal year 2003 IRS financial audit, GAO noted that IRS had taken steps to monitor compliance with this requirement. Additionally, this item is included in FMS' monitoring/oversight checklist used to monitor compliance with this requirement as well as in the LPG. GAO noted no exceptions during its observations.

IRS stated that the requirement to control visitor access was previously listed in the 2002 LPG, issued January 1, 2002. During the on-site security reviews, IRS/FMS security teams observe the sites' handling of visitors to ensure that the banks meet this requirement. Additionally, during peak visits, a lockbox coordinator observes adherence to this requirement. The visitor access requirement is documented in Section 2.6.2 of the 2003 LPG, issued January 31, 2003. During its fiscal year 2003 IRS financial audit, GAO verified that the requirement was included in the LPG, and that IRS had taken steps to monitor compliance with this requirement. Additionally, this item is included in FMS' monitoring/oversight checklist.

During its fiscal year 2003 IRS financial audit, GAO verified that IRS had taken steps to monitor compliance with this requirement. Additionally, this item is included in FMS' monitoring/oversight checklist used to monitor compliance with this requirement, as well as in the LPG. GAO noted no exceptions during its observations.

IRS reported that surveillance cameras have been installed at all lockbox sites. Security review teams continually monitor compliance. These procedures were updated in Section 2.4.1 of the 2003 (revised April 8, 2003) and the 2004 LPG, issued December 1, 2003. The 2005 LPG, under LPG 4.1.4.1.4, directs the documentation of the role and responsibilities for closed-circuit television (CCTV) monitoring by security guards. To help ensure compliance to the LPG requirements, an IRS and FMS task group has developed a Performance Measures process to include a category for Security and Internal Control to be piloted January through September 2005 and to be implemented October 2005. This process will utilize a DCI check sheet that will list by line items the requirements as outlined in the LPG. It will be used as a tool to identify varying levels of performance and provide incentives and disincentives based on those levels of performance. This will help ensure compliance with the requirements as set forth in the LPG and will help IRS identify if and where improvements are necessary. During the fiscal year 2004 audit, GAO found no instances in which a bank did not have surveillance cameras and monitors installed that allowed for effective, real-time monitoring of lockbox operations at the four lockbox banks we visited.

Effective October 2005, IRS began conducting candling reviews at all Lockbox bank sites to ensure all candling requirements are met. These internal control reviews ensure that envelopes opened (manually or by OPEX) on three or more sides are candled once and that envelopes other than the ones opened on three or more sides are candled twice. The results of these reviews are used to calculate each bank's performance score. As a result of implementing these measures in the first year, an unfavorable score can result in IRS deeming the subject bank ineligible to bid for new work or additional volume, loss of current work, or placing the bank in a probationary status. GAO verified that lockbox management conducts reviews to ensure that envelopes are properly candled. During its audit of IRS's fiscal year 2006 financial statements, it did not find any instances in which envelopes were not being properly candled at the four lockbox banks that it visited.

IRS stated that the 2005 LPG 3.2.8.3, Documentation of Items Found in Candling (Form 9535) (1), was revised to require the responsible manager to initial the Form 9535 everyday for each shift. An entry must be made each shift, whether or not items have been found. A manager will initial Form 9535 to validate all of the following: (1) all available information is correctly entered, (2) items found have been reconciled with Form 9535 entries, (3) items have been correctly categorized as "processable" or "unprocessable," (4) all "processable" work has been cleared after each shift, i.e. the work has been put back into the stream of work, and (5) the received date has been correctly entered. Additionally under LPG 3.2.8, IRS revised the requirement to state that envelopes opened manually or by OPEX mail machine are required to be candled once; all others must be candled twice. In order to help ensure compliance to the LPG requirements, an IRS and FMS task group has developed a Performance Measures process to include a category for Security and Internal Control, which will be implemented in October 2005. This process will utilize a DCI check sheet that will list by line items the requirements as outlined in the LPG. It will be used as a tool to identify varying levels of performance and provide incentives and disincentives based on those levels of performance. This will help ensure compliance with the requirements as set forth in the LPG and will help us identify if and where improvements are necessary. During the fiscal year 2004 audit, GAO found that management at the four lockbox banks it visited performed and adequately documented candling reviews.

IRS reported that the requirement to ensure that returned refund checks are restrictively endorsed immediately upon extraction was previously listed in Section 3.2.1 of the 2002 Lockbox Processing Guidelines (LPG) issued January 1, 2002, as well as the 2003 (revised April 8, 2003) and 2004 LPG, issued December 1, 2003. During the on-site security reviews, IRS and Financial Management Service security teams reviewed adherence to this requirement. Additionally, adherence to this requirement is evaluated during the daily Submission Processing Center quality reviews. During its fiscal year 2005 audit, GAO did not identify any instances where returned refund checks at the lockbox banks were not restrictively endorsed upon extraction.

The 2003 LPG, Section 2.7.4, effective January 1, 2003, specifies that guards identify couriers before granting access. Adherence to the requirements was added to the Lockbox Security Check Sheet. Adherence is monitored by the Lockbox FMS and IRS security team during their announced and unannounced security visits. During its fiscal year 2003 IRS financial audit, GAO noted that IRS had taken steps to monitor compliance with this requirement (this item is included in FMS's monitoring/oversight checklist).

The requirement for lockbox sites to obtain favorable results on employees' fingerprint checks before allowing them access to the processing floor was previously listed in the 2002 LPG. The 2003 LPG, Section 2.6.1, effective January 1, 2003, was updated to reflect the new requirements. The FMS and IRS security team reviews personnel files to ensure employees currently working with taxpayer remittances have fingerprint clearance. During its fiscal year 2003 IRS financial audit, GAO verified that the LPG was updated and that IRS has taken steps to monitor compliance.

IRS reported that on September 23, 2003, at the annual Lockbox Conference, the National Background Investigation Center (NBIC) presented the new background investigation requirements for permanent Lockbox bank employees, couriers, and guards. The new procedures require a moderate risk National Agency Check with Law and Credit investigation on all permanent bank employees, couriers, and guards. The banks were given an implementation schedule beginning October 1, 2003, with full implementation by April 1, 2004. On December 15, 2003, the Lockbox Project Office sent out a Lockbox Electronic Bulletin with the 2004 LPG containing the revised background investigation requirements under L.P.G.4.2, Personnel Security and L.P.G.5.1.2(5). During the fiscal year 2004 audit, GAO verified that the LPG had been revised to require that before lockbox bank couriers receive access to taxpayer data and receipts they undergo and receive favorable results on background investigations. GAO found no instances where couriers received access to taxpayer data and receipts without having undergone and received favorable results on background investigations.

IRS reported that on September 23, 2003, at the annual Lockbox Conference, NBIC presented the new background investigation requirements for permanent Lockbox bank employees, couriers and guards. The new procedures require a moderate risk National Agency Check with Law and Credit (NACLC) investigation on all permanent bank employees, couriers and guards. The banks were given an implementation schedule beginning October 1, 2003 with full implementation by April 1, 2004. On December 15, 2003, the Lockbox Project Office sent out a Lockbox Electronic Bulletin with the 2004 LPG containing the revised background investigation requirements under L.P.G.4.2, Personnel Security and L.P.G.5.1.2(5). GAO verified that the 2004 LPG was revised to require all permanent employees assigned to a lockbox bank to have a NACLC investigation. GAO did not identify any instances during its fiscal year 2004 audit in which permanent employees with unescorted access to the processing area did not have a NACLC background investigation.

IRS reported that the 2003 LPG, Section 2.7.4, which was effective January 1, 2003, was updated to include this requirement. During its fiscal year 2003 IRS financial audit, GAO reviewed a Lockbox Electronic Bulletin alert that revised the LPG to require that guards inspect courier vehicles for unauthorized passengers and unlocked doors. GAO did not identify any instances where guards did not inspect courier vehicles for unauthorized passengers and unlocked doors during the fiscal year 2003 audit.

IRS reported that in the 2003 LPG, Section 3.2.8, effective January 1, 2003, candling procedures for the various types of extraction methods were clarified. Splitting the envelope on three sides and flattening the envelope is sufficient to meet candling requirements. This process is sufficient to meet the candling requirements without further light source viewing. All other methods of extraction require viewing the envelope twice, through a light source. During its fiscal year 2003 IRS financial audit, GAO verified that the LPG revision clarified the candling procedures for the various types of extraction methods.

IRS reported that on April 2, 2003, it instructed the banks to change the quality review process for candling. The new procedures require that banks track which machines and which employees missed items. The procedures were effective April 14, 2003, and included in the 2004 LPG, issued December 1, 2003. During the fiscal year 2004 audit, GAO verified that procedures requiring that lockbox banks track which machines and which employees missed items were included in the 2004 LPG. In its visits to four lockbox banks, GAO did not identify any instances where lockbox bank employees did not record which machines and which extraction clerks missed items during candling.

IRS reported that instructions for candling have been revised to require management to reconcile items to the Form 9535. The 2003 LPG was updated on January 31, 2003, per Lockbox Electronic Bulletin alert, to include this requirement in the LPG. During its fiscal year 2003 IRS financial audit, GAO verified that the LPG had been revised to incorporate this requirement. During the fiscal year 2004 audit, GAO did not identify any instances during its visits to four lockbox banks where lockbox bank management did not reconcile items found during candling to the candling records.

IRS reported that all cash receipts are documented on Form 9535. LPG 2003 was updated on January 31, 2003, to include the requirement to document immediately and for management to reconcile payments. During its fiscal year 2003 IRS financial audit, GAO verified that the LPG had been revised to incorporate this requirement. During the fiscal year 2004 IRS financial audit, GAO did not identify any instances during its visits to four lockbox banks where cash payments were not reconciled to the internal cash logs that lockbox bank management provided to IRS.

The January 1, 2003, LPG included a requirement for a lockbox site to notify the SPC Lockbox Coordinator if it receives timely postmarked mail after the grace period. The Lockbox Coordinator will provide instructions for processing and assess the need for further postmark review. During its fiscal year 2003 IRS financial audit, GAO verified that the LPG had been revised to incorporate this requirement.

IRS and FMS completed this analysis prior to the expiration of the current lockbox agreements.

IRS reported that it and FMS are continuing to analyse how best to satisfy the IRS's remittance processing needs. IRS reported that it and FMS would complete this analysis prior to the expiration of the current lockbox agreements. GAO will continue to evaluate IRS's progress on this issue as part of its annual IRS financial statement audits.

IRS's has taken numerous actions to address significant internal issues at lockbox banks. These actions, taken in combination with similar improvements at service center campuses, have reduced the magnitude of remaining internal controls issues to a level that GAO no longer considers remaining issues to consititute a significant deficiency in internal controls. Due to the signficant volume of tapayer receipts and data processed by these locations, GAO will continue to actively monitor the effectiveness of these controls over time.