Management Report: Internal Revenue Service Needs to Improve Financial Reporting and Information System Controls

What GAO Found

During its audit of the Internal Revenue Service’s (IRS) fiscal years 2020 and 2019 financial statements, GAO identified new information system control deficiencies related to access controls and security management that contributed to IRS’s continuing significant deficiency in its internal control over financial reporting systems. These new deficiencies, along with unresolved information system control deficiencies from GAO’s prior audits, increase the risk of unauthorized access to, modification of, or disclosure of financial reporting and taxpayer data and disruption of critical operations. GAO also identified a new control deficiency related to tax credits that although not considered a material weakness or significant deficiency, nonetheless warrants IRS management’s attention in order to help reduce the risk of erroneous and fraudulent refund disbursements.

GAO is making one recommendation in this report to address the control deficiency in security management. In the LIMITED OFFICIAL USE ONLY report, GAO is making five recommendations: four recommendations to address control deficiencies in access controls and one recommendation to address a control deficiency in tax credits.

In addition, GAO found that IRS had completed corrective actions to close 48 of 162 recommendations from GAO’s prior audits related to control deficiencies that remained open as of September 30, 2019. Specifically, IRS’s actions addressed:

• four of 13 transaction cycle recommendations, 

• 41 of 132 information system recommendations, and

• three of 17 safeguarding recommendations.

In the LIMITED OFFICIAL USE ONLY report, GAO communicated to IRS management the status of previously reported recommendations as of September 30, 2020. As a result, IRS has the following GAO recommendations to address:

• 10 transaction cycle recommendations, which consist of nine prior recommendations and the one new recommendation related to tax credits that GAO is making in the LIMITED OFFICIAL USE ONLY report;

• 96 information system recommendations, which consists of 91 prior recommendations, one new recommendation related to security management that GAO is making in this report, and four new recommendations related to access controls that GAO is making in the LIMITED OFFICIAL USE ONLY report; and

• 14 safeguarding recommendations.

Why GAO Did This Study

GAO audits IRS’s financial statements annually. As part of these audits, GAO assesses the effectiveness of IRS’s internal control over financial reporting.

This report presents the new deficiencies in internal control over financial reporting identified during GAO’s audit of IRS’s fiscal years 2020 and 2019 financial statements. This report also includes the results of GAO’s fiscal year 2020 follow-up on the status of IRS’s corrective actions to address recommendations contained in GAO’s prior years’ reports that were open as of September 30, 2019.