Management Report:

IRS's First-Year Implementation of the Requirements of the Office of Management and Budget's (OMB) Revised Circular No. A-123

GAO-07-692R: Published: May 18, 2007. Publicly Released: May 18, 2007.

Additional Materials:

Contact:

Steven J. Sebastian
(202) 512-9521
contact@gao.gov

 

Office of Public Affairs
(202) 512-4800
youngc1@gao.gov

This letter summarizes our review of the Internal Revenue Service's (IRS) implementation of the requirements of the Office of Management and Budget's (OMB) revised Circular No. A-123, Management's Responsibility for Internal Control (A-123) during fiscal year 2006. These requirements are applicable to the 24 Chief Financial Officer (CFO) Act agencies, including the Department of the Treasury (Treasury), of which IRS is a significant component. The objectives of our review, which was conducted as part of our audit of IRS's fiscal year 2006 financial statements, were to determine whether (1) IRS appropriately planned and implemented its assessment of internal controls over financial reporting in accordance with the requirements of OMB Circular No. A-123, (2) IRS performed sufficient work to support its related assurance statement to Treasury, and (3) IRS's assurance statement appropriately represented the status of IRS's internal control over financial reporting.

IRS appropriately planned and implemented its first-year assessment of internal controls over financial reporting in accordance with the requirements of OMB Circular No. A-123 sufficient to support its assurance statement to Treasury as of June 30, 2006. However, full implementation of the requirements of the revised OMB Circular No. A-123 at an agency as large and complex as IRS is a major undertaking that will require a significant commitment of resources and several years to achieve. As we noted in our report on our audit of IRS's fiscal year 2006 financial statements and communicated to IRS and communicated to IRS during the course of our audit, we identified several areas where IRS could enhance its A-123 review process. Specifically, we found that IRS did not always clearly document procedures performed or how test results were linked to the resultant conclusions. In addition, although IRS was aware of the findings of audits performed by GAO and the Treasury Inspector General for Tax Administration (TIGTA), we did not always find documentation that these findings were consistently utilized by IRS in planning its A-123 reviews. We also did not find documentation that in planning its A-123 review, IRS appropriately considered the most recent audit of the Department of Agriculture's National Finance Center, which processes IRS's payroll transactions, or the extent to which its own information security work conducted in accordance with the Federal Information Security Management Act of 2002 (FISMA), met the objectives of OMB Circular No. A-123. Identifying existing reviews and audits related to internal controls over financial reporting, determining the extent to which these efforts can be used to complement the A-123 work, and assessing how that use might affect the scope and nature of procedures to be performed are an important part of the related planning process. Clearly documenting procedures conducted and consideration of existing reviews and audits reduces the risk that IRS may provide a degree of assurance on the effectiveness of its control over financial reporting that is not warranted by existing conditions. We also found that while the scope and nature of A-123 procedures performed by IRS during fiscal year 2006 were appropriate in the circumstances, as IRS's A-123 process moves to the next stage, additional work will be required. We found that (1) the tests IRS conducted focused on the execution of controls over individual transaction types, and have not yet effectively addressed the design of controls; (2) IRS has not yet tested controls over compliance with all significant financial-reporting-related laws and regulations; and (3) information security work IRS conducted under FISMA did not identify many of the vulnerabilities we identified during our testing of its information security as part of our fiscal year 2006 financial audit. Consequently, IRS's A-123 process was not at a point where it would have identified all of IRS's existing control deficiencies nor been sufficient to support an unqualified statement of assurance as of June 30, 2006, had that been appropriate in the circumstances. Also, once IRS is in a position to support an unqualified assurance statement, it will become necessary for it to conduct follow-up procedures during the last 3 months of the year subsequent to the June 30 A-123 reporting date to support an unqualified assurance statement as of September 30 to correspond with the date of our opinion on the effectiveness of IRS's internal controls. Because IRS had four material weaknesses in its internal controls in fiscal year 2006, the additional procedures that would be needed to support unqualified assurance were not necessary. However, IRS is working diligently to resolve its material weaknesses. As these issues are resolved, the scope and nature of procedures IRS will need to perform will gradually increase.

Status Legend:

More Info
  • Review Pending-GAO has not yet assessed implementation status.
  • Open-Actions to satisfy the intent of the recommendation have not been taken or are being planned, or actions that partially satisfy the intent of the recommendation have been taken.
  • Closed-implemented-Actions that satisfy the intent of the recommendation have been taken.
  • Closed-not implemented-While the intent of the recommendation has not been satisfied, time or circumstances have rendered the recommendation invalid.
    • Review Pending
    • Open
    • Closed - implemented
    • Closed - not implemented

    Recommendations for Executive Action

    Recommendation: To assist IRS in strengthening its implementation of A-123 reviews in future years, IRS should begin devising appropriate A-123 follow-up procedures for the last 3 months of the fiscal year to be implemented once the material weaknesses identified through the annual financial statement audits have been resolved.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Closed - Implemented

    Comments: During GAO's audit of IRS's fiscal year 2009 financial statements, it verified that IRS began to devise appropriate follow-up procedures for the last 3 months of the fiscal year. GAO obtained and reviewed IRS's testing plans and determined the procedures to be effective.

    Recommendation: To assist IRS in strengthening its implementation of A-123 reviews in future years, IRS should work with Treasury to identify laws and regulations that are significant to financial reporting, test controls over compliance with those laws and regulations, and evaluate and report on the results of such control reviews.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Closed - Implemented

    Comments: In fiscal year 2008, GAO verified that IRS identified, planned and conducted appropriate tests of internal controls over compliance with laws and regulations that are significant to financial reporting.

    Recommendation: To assist IRS in strengthening its implementation of A-123 reviews in future years, IRS should revise test plans to include appropriate consideration of the design of internal controls in addition to implementation of controls over individual transactions.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Closed - Implemented

    Comments: During GAO's audit of the Internal Revenue service's (IRS) fiscal year 2006 financial statements, it found that IRS did not include appropriate consideration of the design of internal control in its approach to implementing the requirements of OMB Circular A-123, Management's Responsibility for Internal Control. In response to GAO's recommendation to address this issue, IRS expanded its OMB A-123 test plans in fiscal year 2010 to encompass the design of internal control. During GAO's audit of IRS's fiscal year 2010 financial statements, it reviewed IRS's A-123 test plans and verified that they encompassed appropriate consideration of the design of control. Also, GAO reviewed work papers documenting IRS's OMB A-123 work on the design of its internal control for fiscal year 2010, and found that for all transactions IRS tested, it appropriately considered the design of internal control as directed in its respective test plans.

    Recommendation: To assist IRS in strengthening its implementation of A-123 reviews in future years, IRS should, to the extent that it intends to use the information security work conducted under FISMA to meet related A-123 requirements, identify the areas where the work conducted under FISMA does not meet the requirements of OMB Circular No. A-123 and, considering the findings and recommendations of our work on IRS's information security, expand FISMA procedures or perform additional procedures as part of the A-123 reviews to augment FISMA work.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Closed - Implemented

    Comments: In fiscal year 2009, IRS implemented a review process for evaluating controls over information technology relating to financial reporting. The review focused on the systems that affect recording of financial transactions and included assessing the annual FISMA evaluations of CFO oriented financial systems. During GAO's fiscal year 2010 IRS financial audit, it reviewed IRS's OMB A-123 support for its FISMA work related to the evaluation of internal controls over systems that record financial transactions, and its assessment of the annual FISMA report on IRS's information security program to determine if it met OMB A-123 requirements. GAO concluded that IRS's A-123 test procedures related to its FISMA reviews were adequate, appropriately conducted, and documented, in all material respects. GAO also agreed with IRS's conclusion that it met OMB A-123 requirements, in the context of a pre-existing material weakness in information security

    Recommendation: To assist IRS in strengthening its implementation of A-123 reviews in future years, IRS should clearly document how it considered existing reviews and audits in determining the nature, scope, and timing of procedures it planned to conduct under its A-123 process.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Closed - Implemented

    Comments: IRS revised its OMB Circular A-123 implementation guidance to document its consideration of prior reviews and audits. In fiscal year 2008, GAO verified that IRS documented how it considered existing reviews and audits in determining the nature, scope, and timing of procedures it planned to conduct under its A-123 process. IRS also included a requirement in its A-123 Guidance to determine the adequacy and value of management actions taken in response to audits performed by GAO and the TIGTA relating to financial reporting. GAO also verified that IRS review staff followed the A-123 Guidance in performing A-123 reviews.

    Recommendation: To assist IRS in strengthening its implementation of A-123 reviews in future years, IRS should document the results of internal control tests conducted in a manner sufficiently clear and complete to explain how control procedures were tested, what results were achieved, and how conclusions were derived from those results, without reliance on supplementary oral explanation.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Closed - Implemented

    Comments: In fiscal year 2008, IRS revised its A-123 Guidance to include templates that clearly outline how to document and explain what control tests were performed, the scope of control tests, and the results of control tests performed. GAO verified that IRS's work papers documenting fiscal year 2008 A-123 testing substantially conformed to the A-123 Guidance.

    Recommendation: To assist IRS in strengthening its implementation of A-123 reviews in future years, IRS should provide A-123 review staff appropriate training, such as that available for financial auditors, to enhance their skills in workpaper documentation, identification and testing of internal controls, and evaluation and documentation of results.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Closed - Implemented

    Comments: In fiscal year 2008, GAO verified that IRS developed and conducted an appropriate annual training workshop designed to ensure that their A-123 review staff enhance their skills in work paper documentation, identification and testing of internal controls, and evaluation and documentation of test results.

    Jul 22, 2014

    Jun 17, 2014

    Jun 11, 2014

    Jun 10, 2014

    May 28, 2014

    May 21, 2014

    May 12, 2014

    May 7, 2014

    Apr 30, 2014

    Looking for more? Browse all our products here