Skip to main content

Management Report: Improvements Needed in IRS's Internal Controls

GAO-08-368R Published: Jun 04, 2008. Publicly Released: Jun 04, 2008.
Jump To:
Skip to Highlights

Highlights

In November 2007, we issued our report on the results of our audit of the Internal Revenue Service's (IRS) financial statements as of, and for the fiscal years ending, September 30, 2007, and 2006, and on the effectiveness of its internal controls as of September 30, 2007. We also reported our conclusions on IRS's compliance with significant provisions of selected laws and regulations and on whether IRS's financial management systems substantially comply with the requirements of the Federal Financial Management Improvement Act of 1996 (FFMIA). The purpose of this report is to discuss issues identified during our audit of IRS's financial statements as of, and for the fiscal year ending, September 30, 2007, regarding internal controls that could be improved for which we currently do not have a specific recommendation outstanding. Although not all of these issues were discussed in our fiscal year 2007 audit report, they all warrant management's consideration. This report contains 24 recommendations that we are proposing IRS implement to improve its internal controls. We will issue a separate report on the implementation status of recommendations from our prior IRS financial audits and related financial management reports, including this one. We conducted our audit in accordance with U.S. generally accepted government auditing standards.

Recommendations

Recommendations for Executive Action

Agency Affected Recommendation Status
Internal Revenue Service The Commission of Internal Revenue should direct appropriate IRS officials to verify that when it becomes fully operational, Custodial Detail Data Base (CDDB), when used in conjunction with IRACS, will provide IRS with the direct transaction traceability for all of its tax-related transactions as required by the U.S. Government Standard General Ledger (SGL) and Federal Financial Management Systems Requirements (FFMSR), and thus FFMIA.
Closed – Implemented
GAO's fiscal year 2010 audit found that IRS's financial management systems substantially complied with the U.S. Standard General Ledger (USSGL) at the transaction level. GAO determined that the Redesigned Revenue Accounting and Control System (RRACS) posted revenue and refund transactions in substantial conformance with the USSGL. In addition, GAO found that IRS recorded taxes receivable in substantial conformance with the USSGL because adjustments were recorded in accordance with the USSGL, and the reported gross taxes receivable balance could be traced through the adjustments to the unadjusted federal taxes receivable balance, and from there to underlying transaction detail, which had also been recorded in accordance with the USSGL.
Internal Revenue Service The Commissioner of Internal Revenue should direct appropriate IRS officials to document and implement the specific procedures to be performed by the statistician in each step of the unpaid assessments estimation process.
Closed – Implemented
During fiscal year 2010, IRS finalized documentation detailing the specific procedures to be performed by IRS's statistician in each step of the unpaid assessment estimation process. GAO confirmed that IRS implemented these detailed steps as part of its formal unpaid assessments estimation process during fiscal year 2010.
Internal Revenue Service The Commissioner of Internal Revenue should direct appropriate IRS officials to document and implement specific detailed procedures for reviewers to follow in their review of unpaid assessments statistical estimates. Specifically, IRS should require that a detailed supervisory review be performed to ensure: (1) the statistical validity of the sampling plans, (2) data entered into the sample selection programs agree with the sampling plans, (3) data entered into the statistical projection programs agree with IRS's sample review results, (4) data on the spreadsheets used to compile the interim projections and roll-forward results trace back to supporting statistical projection results, and (5) the calculations on these spreadsheets are mathematically correct.
Closed – Implemented
During fiscal year 2010, IRS finalized documentation detailing the specific procedures to be performed by supervisors in reviewing the work of its statistician in preparing IRS's unpaid assessments statistical estimates. The guidance includes specific procedures to ensure: (1) the statistical validity of the sampling plans, (2) data entered into the sample selection programs agree with the sampling plans, (3) data entered into the statistical projection programs agree with IRS's sample review results, (4) data on the spreadsheets used to compile the interim projections and roll-forward results trace back to supporting statistical projection results, and (5) the calculations on these spreadsheets are mathematically correct. GAO confirmed that IRS implemented these detailed steps as part of its formal unpaid assessments estimation process during fiscal year 2010.
Internal Revenue Service To address the inconsistency in assigning the effective date of an accuracy penalty, the Commissioner of Internal Revenue should direct the appropriate IRS officials to modify the Business Master File (BMF) computer program so that the date of the deficiency assessment is used as the effective date of any related accuracy penalty.
Closed – Implemented
IRS changed the computer program for calculating accuracy related penalties in its Business Master File to assign the effective date of the accuracy penalty to match the date of the related deficiency assessment. The change makes the assessment of accuracy related penalties in its Business Master File consistent with how IRS calculates accuracy-related penalties in its Individual Master File. GAO reviewed IRS's documentation showing the implementation of the programming change as well as the results of its internal tests and verified that the programming change functioned as intended.
Internal Revenue Service To address other issues that may exist in IRS's master files that affect penalty calculations, the Commissioner of Internal Revenue should direct appropriate IRS officials to complete and document the review of existing programs in the master files that affect penalty calculations to identify any instances in which programs are not functioning in accordance with the intent of the Internal Revenue Manual (IRM).
Closed – Implemented
GAO confirmed that IRS completed its review of existing master file computer programs that affect penalty calculations and documented a listing of instances in which programs are not functioning in accordance with the intent of the Internal Revenue Manual.
Internal Revenue Service To address other issues that may exist in IRS's master files that affect penalty calculations, the Commissioner of Internal Revenue should direct appropriate IRS officials to, in instances where programs are not functioning in accordance with the intent of the IRM, take appropriate action to correct the programs so that they function in accordance with the IRM.
Closed – Implemented
IRS completed an internal assessment of its penalty computation programs and identified 19 programming issues that caused its financial system to record erroneous penalty assessments in taxpayer accounts. As of September 30, 2018, IRS provided us with supporting documentation validating that it had addressed and corrected all 19 of the identified programming issues. IRS's actions sufficiently address our recommendation.
Internal Revenue Service The Commissioner of Internal Revenue should direct appropriate IRS officials to develop and provide comprehensive guidance to assist TAC managers in conducting reviews of outlying TACs and documenting the results. This guidance should include a description of the key controls that should be in place at outlying TACs, specify how often these key controls should be reviewed, and specify how the results of each review should be documented, including follow-up on issues identified in previous TAC reviews.
Closed – Implemented
GAO verified that all of the reviews assessing controls over taxpayer receipts and information are documented in the TSRRD. IRS also stated that managers and staff were required to participate in CPE training on how to use the TSRRD and certify completion prior to filing season, and that Group Managers in place reviewed the Filing Season Readiness Workshop.
Internal Revenue Service The Commissioner of Internal Revenue should direct appropriate IRS officials to establish a process to periodically update and communicate the specific required reviews for all off-site TAC managers.
Closed – Implemented
GAO confirmed that IRS established a process to periodically update and communicate the specific required reviews for all off-site Taxpayer Assistance Center (TAC) managers through quarterly reminders and reviewing and monitoring the status of corrective actions noted during operational reviews. In addition, IRS outlined the reviews that TAC managers are required to conduct in its Internal Revenue Manual.
Internal Revenue Service The Commissioner of Internal Revenue should direct appropriate IRS officials to establish a mechanism to monitor compliance with the existing requirement that TAC employees responsible for accepting taxpayer payments in cash have their computer system access appropriately restricted to limit their ability to adjust taxpayer accounts.
Closed – Implemented
IRS mandated the use of the restrict command codes to Taxpayer Assistance Center (TAC) employees accepting cash payments to limit their system access rights and ability to adjust taxpayer accounts. These procedures are monitored during operational reviews conducted by area and territory managers, at which time group managers are reminded of the existing requirements to restrict command codes.
Internal Revenue Service The Commissioner of Internal Revenue should direct appropriate IRS officials to establish procedures requiring periodic verification that all individuals designated as first responders to TAC duress alarms are appropriately qualified and geographically located to respond to the potentially dangerous situations in an effective and timely manner.
Closed – Implemented
IRS established procedures in its Internal Revenue Manual requiring quarterly verification that individuals designated as first responders to Taxpayer Assistance Center (TAC) duress alarms are appropriately qualified and geographically located to respond to the potentially dangerous situations in an effective and timely manner.
Internal Revenue Service The Commissioner of Internal Revenue should direct appropriate IRS officials to modify the IRM to specify qualifications and geographical proximity requirements for individuals designated as first responders to duress alarms at IRS facilities, and to require that the responsibilities and qualifications of all designated first responders be periodically reviewed to verify that over time, they continue to be qualified and appropriately located, and to make any necessary adjustments.
Closed – Implemented
IRS revised the Internal Revenue Manual to specify the qualifications and geographical proximity requirements for individuals designated as first responders and included a provision to require quarterly reviews of this issue.
Internal Revenue Service The Commissioner of Internal Revenue should direct appropriate IRS officials to establish procedures to require documentation demonstrating that favorable background checks have been completed for all contractors prior to allowing them access to TAC and other field offices.
Closed – Implemented
Despite IRS's long standing efforts to work with GSA to reach an agreement to obtain documentation demonstrating favorable background checks have been completed for contractors with unescorted access to IRS space, GSA informed IRS that they were unable to provide adjudication service for contractors working in Facility Security Level I, II and partial III facilities. According to IRS, GSA has been compliant in performing background investigations for all government-owned locations, and leased facilities for Levels IV and for 100 percent occupied Level IIIs. IRS took steps to issue new guidance for facilities to enhance physical controls to safeguard assets, including implementation of daytime cleaning in all leased facilities. In May 2010, IRS issued a new directive regarding the cleaning of all IRS space stating that IRS offices will be cleaned during normal business hours only unless appropriate background investigation procedures have been completed to allow staff access. This directive set a new standard requiring, among other things, that cleaners and other building maintenance or contractor/lessor employees should not be provided access cards or keys to IRS space that would allow them access without IRS employees knowing their presence.
Internal Revenue Service The Commissioner of Internal Revenue should direct appropriate IRS officials to require, in all shredding service contracts, provisions requiring (1) completed background investigations for contractor employees before they are granted access to sensitive IRS information, and (2) periodic, unannounced inspections at off-site shredding facilities by IRS to verify ongoing compliance with IRS safeguards and security requirements.
Closed – Implemented
IRS implemented a National Document Destruction Contract with the National Institute for the Severely Handicapped (NISH) who services 552 (95%) of the 584 facilities needing shredding services. All NISH contracts require that the (1) contractor shall perform background investigations on all employees involved in IRS document destruction and (2) provisions of the contract must allow for, at a minimum, an annual IRS inspection of the contractor facility and operations to ensure the safeguarding of IRS information. For the remaining 32 (5%) facilities not covered under the NISH nationwide contract, IRS provided a Performance Work Statement for Secured Document Destruction Services which has the same requirements as the NISH contract.
Internal Revenue Service The Commissioner of Internal Revenue should direct appropriate IRS officials to revise the IRM to include a requirement that IRS conduct periodic, unannounced inspections at off-site contractor facilities entrusted with sensitive IRS information, document the results, including identification of any security issues, and verify that the contractor has taken appropriate corrective actions on any security issues observed.
Closed – Implemented
IRS has updated the Internal Revenue Manual to require that IRS personnel conduct periodic, unannounced inspections at off-site contractor facilities entrusted with sensitive IRS information and that the results of the inspections be documented.
Internal Revenue Service The Commissioner of Internal Revenue should direct appropriate IRS officials to establish procedures to require obtaining and reviewing documentation of completed background investigations for all shredding contractors before granting them access to taxpayer or other sensitive IRS information.
Closed – Implemented
GAO confirmed that IRS included language in the National Document Destruction contract with the National Institute for the Severely Handicapped (NISH) and non-NISH contract, Performance Work Statement for Secured Document Destruction Services, requiring that shredding contractor companies report to IRS on a quarterly basis the start date and background investigation completion date for each contractor involved in the destruction of IRS information. IRS established procedures to perform annual random reviews of contractor records to ensure compliance.
Internal Revenue Service The Commissioner of Internal Revenue should direct the appropriate IRS officials to reinforce existing policies requiring IRS personnel to use the revised Form 13094 when hiring juveniles.
Closed – Implemented
GAO found that IRS took corrective action to reinforce existing policies requiring verification of information on Form 13094, including contacting the reference directly and documenting the details of the contact by: (1) conducting training for the employment offices on the use of Form 13094 and hiring juveniles, (2) developing and implementing a centralized quality review process to monitor juveniles hired, (3) implementing a centralized spreadsheet documenting all juvenile hires along with the completion of required documentation for hiring, and (4) establishing a system to maintain copies of all Form 13094s to support monthly audits.
Internal Revenue Service The Commissioner of Internal Revenue should direct the appropriate IRS officials to reinforce existing policies requiring IRS personnel to verify the information on Form 13094 by contacting the reference directly and documenting the details of this contact.
Closed – Implemented
During the fiscal year 2011 audit, GAO found that IRS took corrective action to reinforce existing policies requiring verification of information on Form 13094, including contacting the reference directly and documenting the details of the contact, by: (1) conducting training for the employment offices on the use of Form 13094 and hiring juveniles, (2) developing and implementing a centralized quality review process to monitor juveniles hired, (3) implementing a centralized spreadsheet documenting all juvenile hires along with the completion of required documentation for hiring, and (4) establishing a system to maintain copies of all Form 13094s to support monthly audits.
Internal Revenue Service The Commissioner of Internal Revenue should issue a memorandum to Receipt and Control Operations (RCO) Unit staff reiterating existing requirements for (1) supervisory reviews of the processing of TE/GE user fee deposits, and (2) key documentation to be signed and dated by the supervisor as evidence of that review.
Closed – Implemented
GAO verified that IRS issued a memorandum to its operations manager of Receipt and Control to reinforce procedures in its Internal Revenue Manual (IRM) requiring signed supervisory review of user fee deposits. Additionally, during GAO's audit of IRS's fiscal year 2008 financial statements, it did not identify any instances where IRS did not document supervisory review of the user fee deposits tested.
Internal Revenue Service The Commissioner of Internal Revenue should direct appropriate IRS officials to modify existing guidelines to require documentation and implementation of detailed internal control procedures for IRS's purchase card program. Specifically, existing guidelines should be modified to provide for detailed internal control procedures requiring that purchase card approving officials and purchase cardholders sign and date monthly account statements attesting to their review and completion of the required reconciliation process.
Closed – Implemented
GAO confirmed that IRS modified its existing guidelines and fully implemented the Purchase Card Module. However, during GAO's audit of IRS's fiscal year 2008 financial statements, it noted that the purchase card approving official's signature attesting to the review and reconciliation of the monthly statement is now captured electronically by the Purchase Card Module. GAO also noted that the purchase card approving officials were not always electronically reconciling and approving transactions within the required timeframes documented in IRS's existing guidelines. Timely reconciliation and approval of transactions is necessary to help ensure that purchase card transactions are valid and appropriate. GAO issued a new recommendation to address the additional issue in GAO-09-513R, which it subsequently closed (see GAO-10-597) based on further corrective actions taken by IRS.
Internal Revenue Service The Commissioner of Internal Revenue should direct appropriate IRS officials to modify existing guidelines to require documentation and implementation of detailed internal control procedures for IRS's purchase card program. Specifically, existing guidelines should be modified to provide for detailed internal control procedures requiring that purchase cardholders obtain funding approval or verify that funds are available for the intended purpose prior to making a purchase.
Closed – Implemented
GAO confirmed that IRS modified its existing guidelines and fully implemented the Purchase Card Module. During GAO's audit of IRS's fiscal year 2008 financial statements, it noted that purchase cardholders obtained funding approval electronically through the Purchase Card Module prior to making a purchase. The Purchase Card Module directly interfaces with the funding requisition function of IRS's Web-based Requisition Tracking System to verify funds availability.
Internal Revenue Service The Commissioner of Internal Revenue should direct appropriate IRS officials to modify existing guidelines to require documentation and implementation of detailed internal control procedures for IRS's purchase card program. Specifically, existing guidelines should be modified to provide for detailed internal control procedures requiring that purchase card approving officials update and maintain appropriate supporting documentation.
Closed – Implemented
Even though IRS did not modify its existing guidelines to require the purchase card approving official to maintain copies of the purchase cardholder's supporting documentation, GAO confirmed that IRS developed compensating internal control procedures. IRS's existing guidelines require the purchase cardholder to maintain the supporting documentation and for approving officials to ensure that the cardholders have all required documentation. During GAO's audit of IRS's fiscal year 2008 financial statements, it noted that the purchase cardholders maintained appropriate supporting documentation.
Internal Revenue Service The Commissioner of Internal Revenue should direct appropriate IRS officials to modify existing guidelines to require documentation and implementation of detailed internal control procedures for IRS's purchase card program. Specifically, existing guidelines should be modified to provide for detailed internal control procedures requiring that purchase cardholders and purchase card approving officials retain copies of all supporting documents for a reasonable period of time, such as 3 years.
Closed – Implemented
Even though IRS did not modify its existing guidelines, GAO confirmed that the current guidelines require cardholders to maintain supporting documentation for 3 years. IRS's existing guidelines require the purchase cardholder to maintain the supporting documentation and for approving officials to ensure that the cardholders have all required documentation. During GAO's audit of IRS's fiscal year 2008 financial statements, it noted that the purchase cardholders maintained appropriate supporting documentation.
Internal Revenue Service The Commissioner of Internal Revenue should direct appropriate IRS officials to issue a memorandum addressed to all personnel responsible for updating inventory records that reiterates IRS existing policy requiring that new assets be inputted into the inventory system within 10 days after receipt.
Closed – Implemented
IRS issued a memorandum to all personnel responsible for updating inventory dated September 5, 2008. The memorandum reiterated IRS's existing policy requiring that new assets be input into the inventory system within 10 days of receipt and provides additional clarification regarding the timely update of asset inventory records.
Internal Revenue Service The Commissioner of Internal Revenue should direct the appropriate IRS officials to issue a memorandum to employees that reiterates IRS policy requiring all employees to obtain appropriate approval of travel authorizations prior to the initiation of their travel.
Closed – Implemented
We verified that IRS published reminders in their Travel Times newsletter and Leader? Alert notification e-mail to remind employees that they must obtain approvals on travel authorizations prior to the initiation of their travel. Furthermore, during our fiscal year 2011 audit we identified only 1 instance out of 41 travel transactions tested where the employee initiated travel prior to obtaining approval for travel.

Full Report

Office of Public Affairs

Topics

Access controlAccounting proceduresBackground investigationsContract oversightData collectionData integrityDocumentationEmployeesFederal regulationsFinancial managementFinancial management systemsFinancial statement auditsFinancial statementsHuman capital managementInternal controlsPolicy evaluationProgram evaluationProgram managementRecords managementRisk assessmentRisk managementTax administration systemsTax information confidentialityTax return auditsTaxpayersTravel allowancesPolicies and procedures