Management Report:

Improvements Are Needed to Enhance the Internal Revenue Service's Internal Controls and Operating Effectiveness

GAO-11-494R: Published: Jun 21, 2011. Publicly Released: Jun 21, 2011.

Additional Materials:

Contact:

Cheryl E. Clark
(202) 512-9521
contact@gao.gov

 

Office of Public Affairs
(202) 512-4800
youngc1@gao.gov

In November 2010, we issued our report on the results of our audit of the financial statements of the Internal Revenue Service (IRS) as of, and for the fiscal years ending, September 30, 2010, and 2009, and on the effectiveness of its internal control over financial reporting as of September 30, 2010. We also reported our conclusions on IRS's compliance with selected provisions of laws and regulations and on whether IRS's financial management systems substantially comply with the requirements of the Federal Financial Management Improvement Act of 1996. In March 2011, we issued a report on information security issues identified during our fiscal year 2010 audit, along with associated recommendations for corrective actions. The purpose of this report is to present internal control issues identified during our audit of IRS's fiscal year 2010 financial statements for which we do not already have any recommendations outstanding. While two of these issues contributed to a significant deficiency in internal control discussed in our report on the results of our fiscal year 2010 financial statement audit, they all warrant IRS management's attention. This report provides 29 recommendations to address the internal control issues we identified. We will issue a separate report on the status of IRS's implementation of the recommendations from our prior IRS financial audits and related financial management reports, as well as this one.

During our audit of IRS's fiscal year 2010 financial statements, we identified several internal control issues for which we do not already have recommendations outstanding. These issues involved the following: (1) First-Time Homebuyer Tax Credits. IRS's internal controls were not fully effective in identifying instances where taxpayers improperly made duplicate First-Time Homebuyer Credit (FTHBC) claims during fiscal year 2010. (2) Authorization of manual refunds. Manual refund units at two IRS service center campuses (SCC) did not have current lists of officials authorized to approve manual refunds. (3) Authorization of goods and services. IRS did not always obtain approval before requesting and receiving services from vendors as required by IRS policy. (4) Approval of personnel actions. IRS did not always timely approve personnel actions for promotions prior to their effective dates as required by Office of Personnel Management guidelines. (5) Recording time and attendance. IRS did not always record Office of Chief Counsel employees' approved time card changes into IRS's electronic time and attendance system. (6) Verification of National Finance Center payroll changes. IRS did not timely detect payroll errors made by the National Finance Center (NFC), which processes IRS's payroll. (7) Cash receipts at the Beckley Finance Center. IRS did not have internal controls in place to appropriately safeguard and account for cash receipts at the Beckley Finance Center (BFC). (8) Contract employee background investigations. IRS did not ensure that background investigations were performed for certain SCC mail couriers who were transporting mail that included taxpayer information from the SCC to the post office. (9) Deposit courier trip times. Allowable time limits IRS established for some of its deposit courier routes greatly exceeded the average trip time and thus were not effective in identifying potential instances of SCC and lockbox bank deposit couriers making unauthorized stops during transit. (10) Transfer of taxpayer information between processing facilities. A courier vehicle's cargo door was not locked after it was loaded with taxpayer returns and other information, contrary to a requirement in the courier's contract. (11) Document transmittal forms. IRS's Small Business/Self-Employed Division managers were not adequately performing or documenting required reviews of internal control procedures over tracking and monitoring taxpayer receipts and information transmitted between IRS locations. (12) Compliance reviews of off-site processing facilities. IRS did not complete compliance reviews for its off-site processing facilities every 2 years as required by the Internal Revenue Manual (IRM). (13) After dark security controls. IRS's physical security controls intended to help prevent and detect unauthorized access to its processing facilities were not always effective. (14) Property and equipment records. IRS incorrectly recorded the asset purchase price for some assets in its property management system. (15) Disposal process for copiers. IRS disposed of copiers without ensuring that the copiers did not contain confidential taxpayer information or sensitive information on IRS employees or operations on the hard drives. These issues increase the risk that IRS may not prevent or promptly detect and correct (1) unauthorized or improper refunds, purchases, or promotions; (2) errors in the hours credited or amounts paid to staff; (3) loss or theft of cash receipts or taxpayer information; (4) security and control deficiencies at its SCCs and processing facilities; (5) data errors in its property records; and (6) improper disclosure of taxpayer and other sensitive data.

Status Legend:

More Info
  • Review Pending-GAO has not yet assessed implementation status.
  • Open-Actions to satisfy the intent of the recommendation have not been taken or are being planned, or actions that partially satisfy the intent of the recommendation have been taken.
  • Closed-implemented-Actions that satisfy the intent of the recommendation have been taken.
  • Closed-not implemented-While the intent of the recommendation has not been satisfied, time or circumstances have rendered the recommendation invalid.
    • Review Pending
    • Open
    • Closed - implemented
    • Closed - not implemented

    Recommendations for Executive Action

    Recommendation: The Commissioner of the IRS should direct the appropriate IRS officials to issue a memorandum to all business units reminding them that only designated Real Estate Facilities Management (REFM) staff are authorized to dispose of copiers.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Commissioner of the IRS should direct the appropriate IRS officials to establish a policy requiring collaborative oversight between IRS's key offices in determining whether potential service contracts involve routine, unescorted, unsupervised physical access to taxpayer information, thus requiring background investigations, regardless of contract award amount. This policy should include a process for the requiring business unit to communicate to the Office of Procurement and the Human Capital Office the services to be provided under the contract and any potential exposure of taxpayer information to contract employees providing the services, and for all three units to (1) evaluate the risk of exposure of taxpayer information prior to finalizing and awarding the contract and (2) ensure that the final contract requires favorable background investigations as applicable, commensurate with the assessed risk.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: Based on a review of all existing contracts under $100,000 without an appointed COTR that should require contract employees to obtain favorable background investigation results, the Commissioner of the IRS should direct the appropriate IRS officials to amend those contracts to require that favorable background investigations be obtained for all relevant contract employees before routine, unescorted, unsupervised physical access to taxpayer information is granted.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Commissioner of the IRS should direct the appropriate IRS officials to perform a review of all existing contracts under $100,000 that (1) do not have an appointed contracting officer's technical representative (COTR) and (2) do not require that contract employees obtain background investigations to assess whether the services performed under each contract warrant a requirement that contract employees obtain background investigations.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Commissioner of the IRS should direct the appropriate IRS officials to take steps to effectively implement procedures at BFC requiring the amount of cash receipts initially discovered in the mail room to be independently reconciled to the amount deposited and recorded in the general ledger.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Commissioner of the IRS should direct the appropriate IRS officials to take steps to effectively implement procedures at BFC requiring mail room staff to maintain custody of the control log at all times.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Commissioner of the IRS should direct the appropriate IRS officials to take steps to effectively implement procedures at BFC requiring cash receipts to be immediately logged under dual control when first discovered in the mail room.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Commissioner of the IRS should further revise your detailed procedures for implementing the requirement to validate the appropriateness of NFC programming changes after such changes are made. These revisions should (1) clarify the criteria for determining what programming changes will be subject to validation, (2) identify officials responsible for making and documenting these determinations, and (3) require postimplementation statistical sampling from a targeted population that consists of employees who are most likely to be affected by the NFC programming change.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Commissioner of the IRS should direct the appropriate IRS officials to adopt the local field office's timekeeping procedures or similar procedures for entering and verifying the accuracy of time and attendance information entered into Single Entry Time Reporting System (SETR) throughout IRS for use by all units in which employees do not enter their own time charges directly to SETR.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Commissioner of the IRS should direct the appropriate IRS officials to establish procedures to centrally review and monitor the timeliness of personnel action requests and approvals to help ensure compliance with the IRM and applicable OPM regulations and guidance.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Commissioner of the IRS should direct the appropriate IRS officials to establish formal written procedures requiring staff to review purchase contract terms against the goods and services received to date before requesting additional goods or services.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Commissioner of the IRS should direct the appropriate IRS officials to send out a reminder to all staff to follow policies and procedures for obtaining approval and funding of proposed purchases prior to entering into an agreement with vendors.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Commissioner of the IRS should direct the appropriate IRS officials to establish a mechanism to enforce the existing requirement for appropriate managers to immediately notify the manual refund units of any personnel changes affecting the approval or processing of manual refunds. This may be accomplished through mechanisms such as issuing periodic alerts, providing training, having the manual refund unit perform quarterly validations of the list of manual refund approving officials, or a combination of these.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Commissioner of the IRS should direct the appropriate IRS officials to put procedures in place to periodically monitor the effectiveness of the new FTHBC validity checks for the duration of the filing of FTHBC claims to verify that they are working as intended.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Commissioner of the IRS should direct the appropriate IRS officials to establish procedures to provide a consistent methodology for calculating and establishing allowable deposit courier trip time limits to be used by both SCCs and lockbox banks that would assist in detecting potential unauthorized stops or other contractual violations for deposit couriers. Such procedures should include instructions for documenting and supporting how the trip limits were determined and require justification and approval for all established time limits that exceed the average trip time.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Commissioner of the IRS should direct the appropriate IRS officials to establish procedures to require periodic reassessments of, and updates to, deposit courier allowable trip time limits to account for changes in courier routes or other conditions that may affect trip times.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Commissioner of the IRS should direct the appropriate IRS officials to revise the IRM to incorporate the new copier disposal procedures that require that copier hard drives be removed and destroyed or otherwise appropriately cleaned before disposing of copiers.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Commissioner of the IRS should direct the appropriate IRS officials to finalize procedures requiring that copier hard drives be removed and destroyed or otherwise appropriately cleaned before disposing of copiers.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Commissioner of the IRS should direct the appropriate IRS officials to take steps to effectively implement the procedures requiring property staff to verify that the asset purchase price shown in the Asset Management Report agrees with the asset purchase price shown in IFS and to resolve any variances before entering the information into Information Technology Asset Management System (ITAMS).

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Commissioner of the IRS should direct the appropriate IRS officials to revise the nature and scope of the SCCs' and lockbox banks' physical security reviews to include periodic after dark assessments of physical security controls.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Commissioner of the IRS should direct the appropriate IRS officials to revise the post orders for the service center campuses (SCC) and lockbox bank security guards to include specific procedures for timely reporting exterior lighting outages to SCC or lockbox bank facilities management. These procedures should specify (1) whom to contact to report lighting outages and (2) how to document and track lighting outages until resolved.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: Based on the results of an assessment of off-site processing facilities that process taxpayer receipts and related taxpayer information, the Commissioner of the IRS should direct the appropriate IRS officials to revise the IRM to specify the frequency with which compliance reviews should be performed at these facilities.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Commissioner of the IRS should direct the appropriate IRS officials to perform an assessment of the off-site processing facilities to determine the frequency with which compliance reviews should be performed for these locations commensurate with the specific operational activities performed and the assessed level of risk associated with the facility.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Commissioner of the IRS should direct the appropriate IRS officials to define and specify in the IRM what types of IRS facilities constitute a processing facility.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Commissioner of the IRS should direct the appropriate IRS officials to include specifying minimally acceptable steps SB/SE unit managers should follow in documenting the results of required reviews of the document transmittal process.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Commissioner of the IRS should direct the appropriate IRS officials to revise the Internal Revenue Manual (IRM) to include a comprehensive process that Small Business/Self-Employed Division (SB/SE) unit managers should follow when performing reviews of the document transmittal process for determining whether staff are (1) maintaining control copies of document transmittal forms, (2) reconciling all document transmittal forms on a biweekly basis to ensure that all transmittals were received, and (3) following up on transmittals that are not timely acknowledged.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Commissioner of the IRS should direct the appropriate IRS officials to revise the guidance for conducting the periodic reviews of the contract couriers transporting taxpayer information from one IRS processing facility to another to include procedures for (1) physically verifying that courier vehicle cargo doors are locked after picking up this information and remain locked during transit to the final destination and (2) documenting the basis for the reviewer's conclusions.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Commissioner of the IRS should direct the appropriate IRS officials to establish procedures to prevent or detect unauthorized access to taxpayer information in contract courier vehicles during transit. These procedures should detail specific activities to be performed by both the business units sending and receiving the information transported by the contract courier.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Commissioner of the IRS should direct the appropriate IRS officials to enforce existing contractual requirements for the cargo doors of contract courier vehicles to be locked after picking up taxpayer information.

    Agency Affected: Department of the Treasury: Internal Revenue Service

    Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Jul 29, 2014

    Jul 22, 2014

    Jun 17, 2014

    Jun 11, 2014

    Jun 10, 2014

    May 28, 2014

    May 21, 2014

    May 12, 2014

    May 7, 2014

    Looking for more? Browse all our products here