Management Report

Improvements Are Needed in IRS's Internal Controls and Compliance with Laws and Regulations Gao ID: GAO-10-565R June 28, 2010

The purpose of this report is to present internal control and compliance issues identified during our audit of IRS's financial statements as of, and for the fiscal year ending, September 30, 2009, for which we do not already have any recommendations outstanding. Although not all of these issues were discussed in our report on the results of our fiscal year 2009 financial statement audit, they all warrant IRS management's attention.

During our audit of IRS's fiscal year 2009 financial statements, we identified several internal control issues and a compliance issue not addressed by previous recommendations. These issues include the following: 1) IRS's reported balances for taxes receivable and other unpaid tax assessments were not supported by its core general ledger system for tax-administration-related transactions. 2) IRS did not always credit or accurately credit trust fund recovery penalty payments received from one taxpayer to all related taxpayers as required by the Internal Revenue Manual (IRM), resulting in errors in taxpayer accounts. 3) IRS's transaction file of "pre-posted" tax revenue, which was supposed to largely reconcile the difference between IRS's aggregate tax revenue receipts recorded in its general ledger and the detailed-level tax revenue receipts recorded in its master file, was not accurate. 4) IRS did not establish adequate internal controls over its complex process for allocating operation support costs to the programs reported on its statement of net cost. 5) IRS did not always review duplicate refund transcripts, which identify potentially duplicate or erroneous refunds, prior to issuing the refunds as required by the IRM. 6) IRS's service center campuses (SCCs) did not acknowledge the quantity of unprocessable items the lockbox banks shipped to them, even in cases where there were discrepancies between the quantity of unprocessable items the lockbox bank recorded on the transmittal form and the quantity that the SCC actually received. 7) IRS's SCC and field office physical security analysts did not always accurately complete audit management checklists used to assess the physical security and emergency preparedness controls in place at their sites. 8) IRS's taxpayer assistance center group managers did not always accurately assess the status of operational and security controls at their locations. 9) SCC and field office contractors who are provided routine, unescorted, unsupervised physical access to IRS facilities containing taxpayer receipts and information were not required to and did not receive annual security awareness training. 10) IRS's SCC unit security representatives, who are responsible for maintaining security over one of IRS's key tax processing systems, did not always receive or timely complete required initial and refresher training on carrying out their security responsibilities. 11) IRS's employees did not always complete annual mandatory briefing requirements in fiscal years 2008 and 2009. 12) IRS staff did not always confirm or obtain documentation of confirmation with the end user of a purchased product or service that the item was satisfactorily received before entering receipt and acceptance of the good/service into the procurement system. 13) IRS did not always timely deobligate excess obligated funds after the related goods or services were delivered and the remaining funds for those purchases were no longer needed. 14) IRS did not always ensure that upward and downward adjustments to prior-year obligation transactions were properly reported for financial statement reporting purposes. 15) IRS did not comply with requirements in its annual appropriations act. We are making 41 recommendations that, if effectively implemented, should address the internal control and compliance issues we identified. These recommendations are intended to bring IRS into conformance with its own policies, the Standards for Internal Control in the Federal Government, or both, as well as to help ensure IRS's compliance with its appropriations act requirements. We provided IRS with a draft of this report and obtained its written comments. In its comments, IRS agreed with all but three of our 41 recommendations and described actions it had taken, underway, or planned to take to address the control weaknesses described in this report.

Recommendations

Our recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.

Director: Steven J. Sebastian Team: Government Accountability Office: Financial Management and Assurance Phone: (202) 512-9521


GAO-10-565R, Management Report: Improvements Are Needed in IRS's Internal Controls and Compliance with Laws and Regulations This is the accessible text file for GAO report number GAO-10-565R entitled 'Management Report: Improvements Are Needed in IRS's Internal Controls and Compliance with Laws and Regulations' which was released on June 29, 2010. This text file was formatted by the U.S. Government Accountability Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. GAO-10-565R: United States Government Accountability Office: Washington, DC 20548: June 28, 2010: The Honorable Douglas H. Shulman: Commissioner of Internal Revenue: Subject: Management Report: Improvements Are Needed in IRS's Internal Controls and Compliance with Laws and Regulations: Dear Mr. Shulman: In November 2009, we issued our report on the results of our audit of the financial statements of the Internal Revenue Service (IRS) as of, and for the fiscal years ending, September 30, 2009, and 2008, and on the effectiveness of its internal controls as of September 30, 2009. [Footnote 1] We also reported our conclusions on IRS's compliance with selected provisions of laws and regulations and on whether IRS's financial management systems substantially comply with the requirements of the Federal Financial Management Improvement Act of 1996 (FFMIA). In March 2010, we issued a report on information security issues identified during our fiscal year 2009 audit, along with associated recommendations.[Footnote 2] The purpose of this report is to present internal control and compliance issues identified during our audit of IRS's financial statements as of, and for the fiscal year ending, September 30, 2009, for which we do not already have any recommendations outstanding. Although not all of these issues were discussed in our report on the results of our fiscal year 2009 financial statement audit, they all warrant IRS management's attention. This report provides 41 recommendations to address the internal control and compliance issues we identified. We will issue a separate report on the status of IRS's implementation of the recommendations from our prior IRS financial audits and related financial management reports, as well as this one. We conducted our audit in accordance with U.S. generally accepted government auditing standards. Results in Brief: During our audit of IRS's fiscal year 2009 financial statements, we identified several internal control issues and a compliance issue not addressed by previous recommendations. These issues include the following: * IRS's reported balances for taxes receivable and other unpaid tax assessments were not supported by its core general ledger system for tax-administration-related transactions. We found certain systemic limitations in its Custodial Detailed Data Base (CDDB) and other control weaknesses that resulted in errors in taxpayer accounts that, in turn, prevented IRS from using CDDB as its subsidiary ledger to manage, and routinely and reliably report, its balance of unpaid tax assessments. * IRS did not always credit or accurately credit trust fund recovery penalty payments received from one taxpayer to all related taxpayers as required by the Internal Revenue Manual (IRM), resulting in errors in taxpayer accounts. Although IRS automated this process, about half of the penalty payments processed through its automated system still require some error-prone, manual intervention. These errors occurred because IRS staff did not receive sufficient training when IRS fully implemented the automated system and their supervisors did not have sufficient guidance to review these transactions for accuracy. * IRS's transaction file of "pre-posted" tax revenue, which was supposed to largely reconcile the difference between IRS's aggregate tax revenue receipts recorded in its general ledger and the detailed- level tax revenue receipts recorded in its master file,was not accurate.[Footnote 3] This occurred because of errors in the instructions provided to the programmers for extracting the pre-posted tax revenue transactions and IRS's lack of updated desk procedures for the comparison of its general ledger tax revenue collections to its master files. * IRS did not establish adequate internal controls over its complex process for allocating operation support costs to the programs reported on its statement of net cost. This occurred because IRS's policies and procedures--including the IRM and the cost allocation desk guide--do not require controls such as the segregation of duties for the allocation tasks performed or documentation controls to help reduce the risk of errors and omissions in the spreadsheet used to track the allocation progress and status. * IRS did not always review duplicate refund transcripts, which identify potentially duplicate or erroneous refunds, prior to issuing the refunds as required by the IRM. The service center campuses (SCC) that generate the transcripts are required to transmit the data for special cases, such as bankruptcy cases, to centralized units for review. However, IRS did not have written IRM procedures requiring the centralized units to acknowledge receipt of the transcripts and, thus, to establish accountability for reviewing these cases. Consequently, some cases were lost in transit and were not reviewed. * IRS's SCCs did not acknowledge the quantity of unprocessable items-- e.g., unacceptable forms of payment such as traveler's checks, gold coins, and other items of value--the lockbox banks shipped to them, even in cases where there were discrepancies between the quantity of unprocessable items the lockbox bank recorded on the transmittal form and the quantity that the SCC actually received. * IRS's SCC and field office physical security analysts did not always accurately complete audit management checklists used to assess the physical security and emergency preparedness controls in place at their sites. Although IRS issued the checklists to help identify, prevent, and reduce physical security weaknesses, several of the questions on the checklist were unclear and guidance and training were not provided to help ensure accurate completion of the checklists. In addition, there was no requirement that managers or supervisors review the responses prepared by the physical security analysts. * IRS's taxpayer assistance center group managers did not always accurately assess the status of operational and security controls at their locations. We found that this was caused in part by ambiguities in the assessment questions for which they were required to respond, uncertainty as to the scope and intent of certain questions, a lack of guidance and training for completing the assessments, and a lack of managerial oversight and review of the group managers' assessment responses. * SCC and field office contractors who are provided routine, unescorted, unsupervised physical access to IRS facilities containing taxpayer receipts and information were not required to and did not receive annual security awareness training. * IRS's SCC unit security representatives, who are responsible for maintaining security over one of IRS's key tax processing systems, did not always receive or timely complete required initial and refresher training on carrying out their security responsibilities. IRS policy does not clearly designate one position or office with the oversight and enforcement responsibility; consequently, oversight was not effective in ensuring unit security representatives received or received timely essential security training. * IRS's employees did not always complete annual mandatory briefing requirements in fiscal years 2008 and 2009. IRS relied on each of its business units to establish their own policies to track and monitor employees' compliance with the requirements and to follow up on those that have not yet completed the required briefings. However, IRS did not centrally review each business unit's process for tracking, monitoring, and enforcing compliance or the results to ensure that mandatory briefing requirements were met. * IRS staff did not always confirm or obtain documentation of confirmation with the end user of a purchased product or service that the item was satisfactorily received before entering receipt and acceptance of the good/service into the procurement system. This confirmation is essential because often the end user (i.e., the person requesting the good or service) is at a different geographic location than the staff member responsible for entering receipt and acceptance into the system. However, IRS's policy did not specifically instruct staff who are responsible for entering receipt and acceptance to obtain and retain written documentation from end users confirming that a purchased product or service was received before entering receipt and acceptance. * IRS did not always timely deobligate excess obligated funds after the related goods or services were delivered and the remaining funds for those purchases were no longer needed. Although IRS performs periodic reviews of aging unliquidated obligations to identify potential funds for deobligation, the aging criteria for identifying obligations to review was too narrow, thus limiting the effectiveness of the reviews in ensuring that only valid obligations were reported in IRS's general ledger and its financial statements. * IRS did not always ensure that upward and downward adjustments to prior-year obligation transactions were properly reported for financial statement reporting purposes. To better identify and report only valid upward adjustments and valid downward adjustments of prior- year obligations--which are each reported on separate line items in IRS's financial statements--IRS performs a monthly netting process to offset transactions that are accounting corrections and not true adjustments to obligations. However, IRS did not have an adequate review process to identify erroneously linked transactions in the accounting system that, consequently, were improperly netted. * IRS did not comply with requirements in its annual appropriations act. Although that act required IRS to set aside at least $7.487 billion for tax law enforcement and related support activities, [Footnote 4] IRS fell short by about $74 million. IRS attributed the cause to (1) delays in hiring staff for enforcement activities caused by an almost 6-month delay in the enactment of IRS's fiscal year 2009 appropriations, and (2) increased funding for taxpayer services. Together, these factors resulted in a greater portion of its operations support costs (e.g., costs incurred for rent, telecommunications, agencywide administration, and facilities services) being allocated to its taxpayer services program and less to its enforcement program than what it originally estimated. In addition, IRS had about $71 million in fiscal year 2009 operations support appropriations that were unobligated at fiscal year end. Even if IRS could have allocated all of these unobligated operations support funds to enforcement, this would only have helped to reduce, but not eliminate, the shortfall. These issues increase the risk that IRS may fail to prevent or promptly detect and correct (1) errors in crediting taxpayer trust fund recovery penalty payments; (2) errors that could adversely affect the reliability of its financial statements; (3) duplicate or erroneous refunds; (4) discrepancies in the transport of unprocessable items; (5) security and control deficiencies at its SCCs and field offices; (6) improper disclosure of taxpayer data; (7) premature payments to vendors before confirming goods or services have been received; and (8) excess unused obligations reported on the financial statements. In addition, IRS is at increased risk of not complying with requirements established in its annual appropriations act. We are making 41 recommendations that, if effectively implemented, should address the internal control and compliance issues we identified. These recommendations are intended to bring IRS into conformance with its own policies, the Standards for Internal Control in the Federal Government,[Footnote 5] or both, as well as to help ensure IRS's compliance with its appropriations act requirements. We provided IRS with a draft of this report and obtained its written comments. In its comments, IRS agreed with all but three of our 41 recommendations and described actions it had taken, underway, or planned to take to address the control weaknesses described in this report. IRS did not agree with the three recommendations we made to address our finding that IRS did not comply with the legal requirements in its annual appropriations act. In its comments, IRS stated that it fully funded its tax law enforcement activities and met the intent of the law, and it disputed other facts described in our report's discussion of IRS's compliance with the appropriations act. We do not concur with IRS's views on this matter and, as we discuss in further detail at the end of that report section, we stand by the information we are reporting. At the end of our discussion of each of the issues in this report, we have summarized IRS's related comments and provided our evaluation. We have also reprinted IRS's comments in enclosure II. Scope and Methodology: This report addresses issues we identified during our audit of IRS's fiscal years 2009 and 2008 financial statements. As part of our audit, we tested IRS's internal controls over financial reporting and its compliance with selected provisions of laws and regulations. We designed our audit procedures to test relevant controls, including those for proper authorization, execution, accounting, and reporting of transactions. To assess internal controls related to safeguarding taxpayer receipts and information, we visited three SCCs,[Footnote 6] one consolidated campus,[Footnote 7] four lockbox banks,[Footnote 8] nine taxpayer assistance centers (TAC),[Footnote 9] and eight field office units.[Footnote 10] We conducted our fieldwork and related follow up between January 2009 and May 2010. Further details on our audit scope and methodology are included in enclosure I. Unpaid Tax Assessments: During our audit of IRS's fiscal year 2009 financial statements, we continued to find that IRS's reported balances for taxes receivable and other unpaid assessments were not supported by its core general ledger system for tax-administration-related transactions because IRS lacked a fully functioning subsidiary ledger for unpaid tax assessments that would allow it to produce reliable, useful, and timely information with which to manage and routinely report these balances. Unpaid assessments consist of taxes that IRS has recorded as due to the government from taxpayers for which payment has not yet been received.[Footnote 11] In accordance with federal accounting standards, unpaid assessments are placed in one of the following three categories:[Footnote 12] * taxes receivable, which are amounts due from taxpayers for which IRS can support the existence of a receivable through taxpayer agreement (such as the filing of a tax return) or a court ruling favorable to IRS; * compliance assessments, for which neither the taxpayer nor the court has affirmed that the amounts are owed, such as an assessment resulting from an audit of the taxpayer; and: * write-offs, which are any unpaid assessments for which IRS does not expect further collections due to factors such as the taxpayer's bankruptcy, insolvency, or death. Of these three, only taxes receivable are reported on the principal financial statements, with compliance assessments and write-offs presented as supplemental information to the financial statements. Therefore, it is essential for IRS to be able to accurately and routinely classify its unpaid assessments into these three categories in order to present reliable information in its financial statements and to enable management to make informed business decisions based on this complete and reliable information. As we reported in prior years, IRS's balance for federal taxes receivable,[Footnote 13] which comprised nearly 80 percent of IRS's total assets as reported on its fiscal year 2009 balance sheet, was not produced by its general ledger system for tax administration activities, the Interim Revenue Accounting Control System (IRACS). [Footnote 14] While IRS summarizes the detailed transaction information from its master files on IRACS, neither the master files nor IRACS were designed to classify and report unpaid assessments in accordance with federal accounting standards.[Footnote 15] To compensate for this, IRS for years has had to apply statistical sampling and estimation techniques to data from its master files to estimate the year-end balances of (1) taxes receivable in its financial statements and required supplementary information, and (2) compliance assessments and write-offs in its required supplementary information. To partially address this issue, we previously recommended that as part of IRS's efforts to modernize its systems, it include plans to develop a subsidiary ledger to accurately and promptly identify, classify, track, and report all IRS unpaid assessments by amount and taxpayer. We noted that this subsidiary ledger needed to have the capability to distinguish unpaid assessments by category in order to identify those assessments that represent taxes receivable versus those that represent compliance assessments and write-offs. Recognizing the seriousness of this deficiency, IRS began phasing in the use of the Custodial Detailed Data Base (CDDB) in 2006.[Footnote 16] According to IRS, one key objective of CDDB is to serve as a transaction-level subsidiary ledger for unpaid tax assessments by linking and classifying taxpayer account information from IRS's master files to IRACS, thus providing for transactional traceability.[Footnote 17] In fiscal year 2008, IRS enhanced CDDB to analyze the unpaid assessment balances, including related interest and penalty accruals, from its master files and record the balances to its general ledger by the various financial reporting categories (taxes receivable, compliance assessments, and write-offs) on a weekly basis. These enhancements established CDDB's capability to function as a transaction-level subsidiary ledger for unpaid tax assessments. However, IRS cannot yet use CDDB as its subsidiary ledger for recording transaction-based tax debt information to its general ledger in a manner that ensures reliable internal and external reporting. While CDDB analyzes and classifies master file tax debt information into the various financial reporting categories, the analysis and classification contain material inaccuracies. For example, IRS itself identified errors necessitating almost $8 billion in adjustments to the 2009 fiscal year-end gross taxes receivable balance produced by CDDB. We identified several systemic limitations in the programs used by CDDB that resulted in misclassifying tax debt accounts among the three financial reporting categories. Specifically, we identified instances in which CDDB was unable to correctly classify an account module because IRS had not written sufficient details into the CDDB classification program to allow it to sort through, identify, and analyze all the relevant transaction-level information required for proper classification.[Footnote 18] For example, when IRS records multiple tax assessments on a single account module, CDDB is currently unable to distinguish among and separately classify the various balances. In one instance we identified, a taxpayer filed a tax return but did not pay the entire amount of the tax liability reported on the return, which resulted in the amount owed being classified as a tax receivable.[Footnote 19] IRS later assessed additional taxes against the taxpayer for the same tax period, but the taxpayer did not concur with the additional tax assessment. Because there was no concurrence by the taxpayer or a court ruling in favor of IRS for the additional tax assessment, this assessment should not have been classified as a taxes receivable; it should have been classified as a compliance assessment. However, CDDB classified the entire outstanding balance as taxes receivable because the taxpayer's master file account module contained information that the taxpayer had filed a tax return. In addition to CDDB's systemic limitations, IRS's management and reporting of unpaid tax assessments also continued to be hindered by control weaknesses that resulted in inaccurate tax records. During our fiscal year 2009 audit, we again found errors in taxpayer records resulting from IRS's not recording information accurately and timely. Examples included IRS's failure to record the receipt of a taxpayer's $3 million payment and, as discussed in the next section of this report, IRS's failure to properly record trust fund recovery penalty payments to all related taxpayer accounts.[Footnote 20] Such errors directly affect the accuracy of the tax debt information being classified by CDDB. Additionally, such errors can cause frustration to taxpayers who either have already paid taxes owed or who owe significantly lower amounts. Internal control standards require that transactions and other significant events be promptly recorded and properly classified to maintain their relevance and value to management in controlling operations and making decisions.[Footnote 21] The standards also require that control activities ensure that all transactions are completely and accurately recorded. Transactions and events are to be properly classified in the summary records from which reports and financial statements are prepared. CDDB's systemic limitations and errors in taxpayer accounts resulted in IRS having to make numerous adjustments as part of its compensating manual process for estimating the balance of net taxes receivable and other unpaid tax assessments. On the basis of a statistical projection of these individual adjustments, IRS had to make almost $8 billion in adjustments to the year-end balances of all three categories of unpaid assessments generated by CDDB in order to produce reliable amounts for external reporting on its balance sheet and required supplementary information. IRS is aware of certain systemic limitations with CDDB, and has already initiated research into enhancing the CDDB classification programs to allow it to analyze some of the more complex unpaid assessment accounts in order to more accurately classify them for financial reporting purposes. Until IRS (1) improves the capabilities of CDDB to analyze the more complex unpaid assessments accounts and correctly classify them, and (2) addresses the control weaknesses that result in errors in taxpayer accounts, the unpaid assessment balances produced by CDDB, including taxes receivables, will continue to be materially inaccurate. This prevents IRS from using CDDB as a reliable subsidiary ledger to effectively manage and routinely and reliably report its balance of unpaid tax assessments, and constitutes a material weakness in IRS's management of unpaid assessments. Additionally, IRS must continue using its compensating statistical estimation process to annually estimate the amount of taxes receivable for financial reporting. Since the taxes receivable balance is produced by this process rather than IRS's general ledger, there is no transactional traceability from the amount of taxes receivable reported on IRS's balance sheet, through the general ledger, back to the underlying account records. Recommendations: We recommend that you direct the appropriate IRS officials to do the following: * Review the results of IRS's unpaid assessments compensating statistical estimation process to identify and document instances where systemic limitations in CDDB resulted in misclassifications of account balances which, in turn, resulted in inaccuracies in the amounts of reported unpaid assessments. * Research and implement programming changes to allow CDDB to more accurately classify such accounts among the three categories of unpaid tax assessments. * Research and identify control weaknesses resulting in inaccuracies or errors in taxpayer accounts that affect the financial reporting of unpaid tax assessments. * Once IRS identifies the control weaknesses that result in inaccuracies or errors that affect the financial reporting of unpaid tax assessments, implement control procedures to routinely prevent, or to detect and correct, such errors. IRS Comments and our Evaluation: IRS agreed with our recommendations to enhance controls over the classification and reporting of its unpaid tax assessments. IRS stated that it has (1) identified programming changes to improve the business rules used by CDDB to accurately classify unpaid tax assessments, (2) identified and scheduled programming changes that would allow more accurate classification of the three categories of unpaid tax assessments, (3) identified and corrected misclassifications of account balances during its review of sample cases each year, and (4) reviewed IRM procedures to ensure controls are in place and are followed. IRS also stated that it would continue to identify and validate the completion of corrective actions. We will evaluate the effectiveness of IRS's actions and monitor its efforts during our audit of IRS's fiscal year 2010 financial statements and future audits. Trust Fund Recovery Penalty Payments: During our fiscal year 2009 audit, we found that IRS did not always credit or accurately credit trust fund recovery penalty payments to all related taxpayers. The Internal Revenue Code grants IRS the broad authority to assess penalties against taxpayers for failing to pay taxes owed or otherwise attempting to evade taxes.[Footnote 22] Employers are required to withhold from their employees' salaries amounts for individual federal income taxes and for Federal Insurance Contribution Act (FICA) taxes, which include Social Security and Hospital Insurance taxes. These withheld taxes are also referred to as "trust fund taxes." Employers are also required to match the amounts withheld from an employees' salary for Social Security and Hospital Insurance taxes. Taken together, the amounts withheld from an employee's salary for federal individual income and FICA taxes, along with the employer's matching portion of the FICA taxes, comprise the business's payroll taxes. When a business willfully fails to account for or pay the taxes it is legally required to withhold from its employees' wages, IRS will assess the outstanding payroll tax and underpayment penalties against the business. To provide the IRS a secondary source of collection for withheld taxes not paid by a business, IRS may impose a trust fund recovery penalty (TFRP) against the responsible officers of the business specifically for the employee- withholding component of the payroll tax liability.[Footnote 23] Although IRS has the authority to assess the TFRP individually against all responsible officers, the full amount of the TFRP assessment need only be paid once. Thus, IRS may record tax assessments against each of several individuals for the employee-withholding component of the payroll tax liability of a given business. When any one of those individuals or the business makes a payment towards this liability, IRS policies require that the payment be properly credited (i.e., the liability reduced) on all related taxpayer accounts associated with the TFRP within 45 days of the payment posting to the payer's tax account.[Footnote 24] During our fiscal year 2009 financial audit, we tested a statistical sample of 92 TFRP payments received by IRS during the first quarter of fiscal year 2009. We found eight instances in which IRS either did not record a reduction to the outstanding payroll tax liability on related taxpayer accounts or did not record the correct amount. For example, in one case, the officer of the business paid over $6,000 related to an outstanding TFRP assessment. However, IRS had not credited the business's payroll tax liability for the amount of the officer's payment when we reviewed the business account 12 weeks after IRS posted the payment to the officer's account. In another case, the officer of a business paid over $95,000 related to an outstanding TFRP assessment. IRS recorded a credit of about $70,000 towards the remaining TFRP balance on his account, and a credit of about $25,000 towards interest accrued on the account. Although IRS should have credited the business's account for the same amounts, it correctly recorded about a $70,000 credit to the business's unpaid payroll tax liability but failed to credit the business for about $25,000 to reduce interest accrued. Based on our testing, we estimate that about 8.7 percent of TFRP payment transactions in the first 3 months of fiscal year 2009 were not credited or accurately recorded on related taxpayer accounts.[Footnote 25] Since the detailed information from the taxpayer account records serves as the underlying basis for IRS's financial statements, erroneous tax records could lead IRS to misstate its unpaid assessments balances. Additionally, inaccurate tax records could cause unnecessary burden to taxpayers. Internal control standards require that transactions be promptly recorded to maintain their relevance and value to management in controlling operations and making decisions. Furthermore, internal controls should help ensure that all transactions are completely and accurately recorded.[Footnote 26] However, the failure to completely and accurately reflect TFRP payments on the accounts of all related taxpayers has been a long-standing internal control weakness at IRS that we reported on following our fiscal year 1997 financial audit. [Footnote 27] The control weakness in the TFRP process was due largely to shortcomings with certain IRS computer systems, specifically its master files. IRS records payroll tax assessments against businesses in its business master file, and records TFRP assessments made against responsible officers in its individual master file. However, IRS's systems were unable to automatically link the account information between the business and the responsible officers, as well as account information between related officers assessed a TFRP for the same business. Consequently, transactions recorded in one account that should have been reflected in other related accounts were not automatically recorded. If the business or one of its officers paid some or all of the outstanding payroll tax or related TFRP, IRS's systems were unable to automatically reflect the payment as a reduction to the outstanding liability in the related accounts. Following our fiscal year 1997 financial audit, we recommended that IRS develop a subsidiary ledger for unpaid assessments that had the capability to, among other things, ensure that all payments made were properly credited to accounts of all individuals assessed for the liability. We also recommended that IRS manually review and eliminate duplicate or other assessments that had already been paid off to ensure that all accounts related to a single assessment were appropriately credited for payments received. Since then, IRS has taken a number of corrective actions in response to our recommendations. For example, IRS phased in the implementation of the Automated Trust Fund Recovery (ATFR) system, which interfaces with the business and individual master files to facilitate the linking of payment information to related parties. One of the key objectives of ATFR is to automatically record a reduction to the outstanding liability of related taxpayer accounts when either the business or any one of the responsible officers makes a payment. IRS officials informed us that while IRS had implemented all phases of ATFR, it can only automatically credit the outstanding liability of related taxpayer accounts for about 54 percent of TFRP payments it processes as of March 2010.[Footnote 28] The remaining 46 percent of TFRP payments processed through ATFR require some form of manual intervention in order to credit the outstanding liability on related taxpayer accounts. Additionally, in 2008 IRS completed special reviews of taxpayer accounts with outstanding TFRP liabilities to identify and correct any previously recorded TFRP payments that had not been accurately credited to all related accounts. The primary focus of these reviews was to correct existing errors in taxpayer accounts but, as shown by our recent testing results, they did not significantly improve controls that would prevent and detect errors as they occurred. The errors we identified in 2009 were primarily caused by a lack of sufficient training and guidance to employees when IRS fully implemented the ATFR system. According to IRS officials, during ATFR's development stage, only a small group of SCC employees were involved with processing TFRP credits to related parties using the ATFR system. When IRS fully implemented ATFR in March 2008, it significantly expanded the number of ATFR users. However, IRS did not issue its ATFR training manual to all affected employees until November 2008, and did not provide formal training until after it had issued the training manual. During the intervening period, IRS provided new users and their immediate supervisors with on-the-job training. As a result of our audit findings, IRS determined that its employees did not fully understand how to properly use the ATFR system and interpret its reports. For example, with more complex TFRP payment transactions, the system will calculate how the payment might be applied to reduce the liability of related taxpayer accounts and issue a transcript reporting the proposed transaction for IRS employees to review. IRS employees are required to research the related parties' accounts to determine the accuracy of the proposed transaction. If their research indicates that the proposed transaction is correct, they can electronically submit the proposed transaction for further processing and updating of taxpayer accounts. If their research indicates that the proposed transaction is not correct, they can delete the proposed transaction and enter a transaction to correctly apply the payment credits to the related parties. However, IRS found that some employees over-relied on the ATFR system's proposals. Specifically, when these employees received the ATFR system reports, they accepted the proposed transaction without verifying its accuracy. In other cases, IRS found that employees deleted the proposed transaction and closed the case without taking any action to reduce the liabilities of the related party accounts. Such examples directly resulted in the inaccurate recording or omission of payment transactions on related taxpayer accounts. Additionally, IRS did not detect these processing errors promptly because supervisors did not have adequate guidance for reviewing TFRP payment transactions processed through the new ATFR system. The current IRM section covering TFRP payment processing under the new ATFR system does not contain specific guidance on supervisory responsibilities for reviewing credit transactions, such as determining whether there should be associated credits resulting from a payment transaction, whether the credits applied to related parties were accurate, and which ATFR system reports would best facilitate supervisory reviews.[Footnote 29] According to IRS officials, supervisors have always performed reviews of TFRP payment processing. However, the reviews were focused more on ensuring the timeliness of processing the payments rather than the accuracy of the credit transactions applied to all related parties. In its attempt to address control weaknesses related to TFRP payment processing, IRS recently implemented and is continuing to implement additional corrective actions. Specifically, IRS officials stated that they provided additional training to IRS staff with emphasis on how to use and interpret ATFR reports and that new users receive more supervision and one-on-one training by more experienced staff. IRS officials also stated that in June 2009 the agency held a summit with key IRS management and first-line employees where these officials emphasized the importance of managerial reviews for accuracy as well as timeliness when reviewing TFRP transactions processed by their staff. Finally, IRS is currently in the process of implementing quarterly reviews led by its Small Business/Self-Employed Division. These quarterly reviews will statistically sample recent TFRP payment transactions to determine the employees' compliance with TFRP processing guidance. However, until it successfully implements effective controls over TFRP payment processing, IRS will continue to experience inaccuracies in the recording of credit information on related taxpayer accounts or failures in crediting the related parties altogether. This contributes to errors in taxpayer accounts, which is a major component of the material weakness in IRS's management of its unpaid assessments.[Footnote 30] Recommendations: To ensure that TFRP payments are always and accurately credited to all related parties when received, we recommend that you direct the appropriate IRS officials to do the following: * Revise the IRM to provide specific requirements for supervisors to review the accuracy of credit transactions related to TFRP payments processed through the ATFR system. This guidance should provide specific areas to review and list the ATFR system reports that can facilitate supervisory reviews. * Formalize and implement the quarterly reviews of TFRP payment transactions to monitor compliance with IRM requirements. * Develop procedures to analyze the results of the quarterly reviews so that specific factors causing the errors are identified. * Develop procedures to address the factors causing errors in the processing of TFRP payment transactions identified through the analyses of the quarterly review results. IRS Comments and our Evaluation: IRS agreed with our recommendations and stated that it updated the IRM in May 2010 to include supervisory reviews of the accuracy and timeliness of credit transactions related to TFRP payments processed through ATFR and identified areas and system reports for review. IRS also stated that it commenced quarterly quality reviews in April 2010 that included analysis of findings and implementation of corrective actions to address identified deficiencies. We will verify the changes to the IRM and evaluate the effectiveness of IRS's efforts during our audit of IRS's fiscal year 2010 financial statements. Tax Revenue Comparisons and Reconciliations: During our fiscal year 2009 financial audit, we found that a component of IRS's comparison of its general ledger tax revenue receipts to detailed transaction support in its master files was not accurate. IRS records and summarizes tax revenue transactions in two distinct paths. The general ledger is used to record and summarize tax revenue receipts by tax class and tax year, and is updated daily based on deposit activity; in contrast, the master files are used to record detailed transaction activity in each taxpayer's account, and are generally updated weekly. IRS performs a comparison between its general ledger and the master files to (1) help compensate for its lack of a subsidiary ledger which would normally contain the underlying detailed records that support the general ledger, (2) ensure that the two independent systems are materially reliable for both internal and external reporting purposes, and (3) account for expected timing differences between the general ledger postings and the master files. However, we found that the pre-posted revenue component of the comparison, which is a reconciling item intended to represent tax revenue transactions that have been recorded in the general ledger but not yet posted to a taxpayer's account on the master files, improperly included (1) exchange non-tax revenue such as reimbursements and user fees, which are accounted for separately from tax revenues, (2) tax revenue collected by IRS that had already been posted to the master files, and (3) misdirected receipts that were sent electronically to IRS, but were not tax revenue collections. IRS's fiscal year 2009 comparison of its general ledger revenue receipts to its master files identified that it recorded $6.2 billion more in receipts in the general ledger than the master files. IRS asserted that approximately $5.1 billion of the $6.2 billion variance consisted of pre-posted tax revenue. However, during our testing of a statistical sample of 59 transactions from the pre-posted revenue file, we found that 20 transactions were (1) non-tax revenue transactions, or (2) tax revenue transactions that had already been posted to the master files. Based on our testing, we estimate that 33.9 percent of the transactions in the pre-posted revenue file IRS provided were not in fact pre-posted revenue.[Footnote 31] Accordingly, we identified the $5.1 billion as an unexplained variance and were unable to rely on IRS's assertion that the transactions in the pre-posted file represented pre-posted tax revenue. Based on the materiality threshold established for the audit, the variance was not considered material to IRS's statement of custodial activity, but it nonetheless pointed to a breakdown in controls. In following up on these exceptions, we found that IRS officials responsible for the comparison did not establish the appropriate controls to ensure that the pre-posted transactions consisted of only tax revenue transactions that were posted in the general ledger but not yet posted in the master files. Specifically, the methodology these officials provided to IRS's computer programmers to create the pre-posted file did not appropriately include provisions for (1) eliminating both exchange non-tax revenue and tax revenue that had already been posted to the master files, and (2) verifying that those transactions were properly eliminated. Also, we found that the desk procedures used to outline the controls in IRS's comparison of its general ledger revenue receipts to its master files had not been updated since November 2001. As a result, these procedures did not document the controls or include detailed instructions addressing the most recent additions to the comparison process, such as the use of CDDB. For example, fiscal year 2009 marked the first year that IRS used CDDB to support the variance analysis of its comparison of general ledger tax revenue receipts to its master files, yet the desk procedures used to perform the comparison did not document the methodology for or mention the use of CDDB as part of the variance analysis. Internal control standards state that control activities, including comparisons and reconciliations, must be clearly documented, periodically updated, and readily available for examination.[Footnote 32] Control activities are an integral part of an entity's planning, implementing, reviewing, and accountability for stewardship of government resources and achieving effective results. However, to be effective, the information upon which comparisons are based must be reliable. Since the pre-posted file is a key reconciling component of the comparison, the data it contains must be sufficiently reliable in order to ensure that the general ledger tax revenue receipts and the tax receipt information in the master files materially reconcile. IRS's inability to rely on the pre-posted file as a proper reconciling component of the comparison and the lack of updated documented procedures over the comparison process increase the risk that errors in the general ledger, the master files, or both, may not be identified and appropriately resolved. Recommendations: We recommend that you direct the appropriate IRS officials to do the following: * Revise the existing methodology for extracting the pre-posted revenue component of the comparison to ensure that non-tax revenues and tax revenue transactions already posted to the master files are properly excluded. * Update the desk procedures governing the comparison of general ledger tax revenue receipts to the master files to ensure that the procedures reflect the current process and controls. IRS Comments and our Evaluation: IRS agreed with our recommendations and stated that it (1) revised the pre-posted extraction methodology in May 2010 to ensure the proper exclusion of transactions such as non-tax revenue and (2) would update the desk procedures for the general ledger to master file comparison by December 31, 2010. We will review IRS's methodology and evaluate the effectiveness of IRS's efforts during our audit of IRS's fiscal year 2010 financial statements and future audits. Cost Allocation Processing: During our fiscal year 2009 financial audit, we found that IRS did not establish adequate internal controls over its process used to allocate operation support costs to programs reported on its statement of net cost. The statement of net cost, one of the basic federal financial statements, is designed to show the net cost of operations for the reporting entity as a whole, by major program.[Footnote 33] While some costs--such as the salaries of staff that work directly for those programs--are easily identified by program, many operation support costs--such as rent and facilities costs, technology support, and payroll operation costs--support multiple programs. Consequently, IRS must properly allocate these costs among its programs in order to report them on its statement of net cost. IRS uses a combination of automated and manual processes monthly to collect and prepare cost information, which is then allocated across IRS's cost centers through the execution of over 600 manually initiated computerized commands, or run cycles.[Footnote 34] The accurate allocation of costs is dependent, in part, on the execution of each cycle in the correct order, with the execution of each cycle reliant on the proper execution of the previous cycle in order to yield the intended results. Because of the complexity of the processes involved and the high degree of manual intervention required, proper controls are necessary to help ensure the reliability of the process and thus, the reliability of the results reported in the financial statements. However, in our review of IRS's controls over the allocation process, we found the following. * Inadequate documentation of controls. Internal control standards state that internal control and all transactions and other significant events need to be clearly documented and the documentation readily available for examination. The documentation should appear in management directives, administrative policies, or operating manuals. [Footnote 35] However, IRS's cost allocation desk guide, which is used by IRS's cost accountants to guide them through the allocation process, did not list or describe all the steps required to perform the allocations; did not identify files used, opened, or saved at each step; did not consistently identify the source of input data; and did not specify points in the process where reviews or accuracy verifications by others were required. * Lack of segregation of duties. Internal control standards state that key duties and responsibilities need to be divided or segregated among different people to reduce the risk of error.[Footnote 36] However, the three IRS cost accountants, who are responsible for performing the monthly cycle runs that allocate the costs, performed all of their assigned processing steps--from validating cost allocation input data to running assigned allocation cycles to evaluating the results of the allocation cycle and documenting their activity--without the participation or intervention of another accountant or a supervisor. Consequently, there is an increased risk that an error made in one allocation cycle--which could affect many subsequent cycles and yield incorrect allocations--may not be detected. * Inadequate documentation on the status of processing steps. Internal control standards state that internal control activities should help ensure that management's directives are carried out and are effective and efficient in accomplishing the agency's controls objectives. These include controls over information processing, such as accounting for transactions in numerical sequence, and controls over the complete, accurate, and prompt recording of all transactions and events. Overall, control activities should help ensure that actions are taken to address risks.[Footnote 37] The cycle run spreadsheet, a key document used by the cost accountants to track the status of over 600 cycle runs as well as the performance of their over 100 manual processing steps and the results, did not contain a field to uniquely identify each row or provide a sort-order to help ensure steps were maintained in sequential order, and was not consistently updated to document the completion and results of the manual steps performed. In addition, the accountants did not maintain one master version of the spreadsheet, but rather duplicated it with each one updating their own copy, then later transferring their updates to the master version. This increases the risk of error or omission. In addition, each month's cycle run spreadsheet was generated by taking the prior month's spreadsheet and manually updating each of over 600 cells one cell at a time to reflect the current month's data. This approach greatly increases the risk of error should one or a few cells be missed. These control weaknesses occurred because IRS's policies--including the IRM and the cost allocation desk guide--did not require controls such as the segregation of duties for the tasks described above or controls to help reduce the risk of errors and omissions in the cycle run spreadsheet. By not requiring the proper documentation and implementation of appropriate controls over the processing of cost allocations, IRS is at increased risk of not detecting erroneous or incomplete cost allocations. Consequently, we could not rely on IRS's controls over its allocation process to ensure program costs were reliably reported in its financial statements. Instead, IRS had to perform a separate, labor-intensive manual allocation process to provide support for the cost allocations that were ultimately reflected on the statement of net cost. Although IRS was able to satisfy us in the end that the amounts reported were reliable, it took a significant investment of time and effort for IRS to perform this ad hoc process and for us to review it. This may not have been necessary had adequate controls been in place. Recommendations: We recommend that you direct the appropriate IRS officials to do the following: * Revise the cost allocation desk guide to better document the cost allocation process. This should include ensuring that all key processing steps are included and identifying the key sources of input data and the controls necessary to help ensure their reliability. * Revise the IRM and cost allocation desk guide to require appropriate segregation of duties within the cost allocation process. * Revise the IRM and cost allocation desk guide to require timely, documented supervisory reviews at key process points to help prevent and detect cost allocation processing errors. Establish controls over the cycle run spreadsheet to help minimize the risk of error or omission. At a minimum, this should include assigning a unique, sortable identifier to each row in the spreadsheet and implementing controls to promptly and accurately record the status of processing steps in a manner that ensures each cycle run is performed and is performed in the proper sequence. IRS Comments and our Evaluation: IRS agreed with our recommendations and has revised the cost allocation desk guide to include key processing steps, key sources of input data, and controls to ensure reliability, and established procedures and controls over the cycle-run spreadsheet to minimize the risk of error or omission. In addition, IRS stated that it will update its IRM and cost allocation desk guide to require appropriate segregation of duties and supervisory reviews by June 30, 2010. We will verify the changes to the cost allocation desk guide and IRM and evaluate the effectiveness of IRS's efforts during our audit of IRS's fiscal year 2010 financial statements. Duplicate/Erroneous Refunds Related to Bankruptcy Cases: During our fiscal year 2009 financial statement audit, we found that IRS did not always review duplicate refund (DUPREF) transcripts, which identify potentially duplicate refunds, prior to issuing the refunds as required by the IRM. This occurred because IRS did not have a process in place to verify the receipt of pertinent taxpayer information from the DUPREF transcripts that had been communicated to the staff responsible for performing the required review. As a result, the DUPREF transcripts were not all reviewed, thus increasing the risk that actual duplicate or erroneous refunds may go undetected and be inappropriately paid to taxpayers. One of the primary tools used by IRS to identify potential duplicate or erroneous refunds is the DUPREF transcript. The DUPREF transcript is a report generated by a computer program that identifies instances in which two or more refunds in amounts within $100 of each other are scheduled to be disbursed and are posted to a taxpayer's account in IRS's master files. The DUPREF transcript is generated 1 week before the related refunds are scheduled to be disbursed. IRS requires its staff to review 100 percent of the DUPREF transcripts to assess the validity of the refunds listed. In most cases, the review is performed by the SCC's Manual Refund Unit. However, in cases related to taxpayers with a particular legal status, such as bankruptcy, special handling is required. If a DUPREF transcript is related to a taxpayer who has filed for bankruptcy, the Manual Refund Unit's standard practice is to fax the pertinent taxpayer information from the DUPREF transcripts on a 3210 transmittal form to IRS's Central Insolvency Operation (CIO) so that CIO can perform the review. CIO then determines if the refund is valid and if not, what steps should be taken to prevent disbursement. During our audit, we found that CIO did not always receive the information for the DUPREF transcripts related to bankruptcy cases that had been provided by the SCC. At one SCC we visited, IRS officials informed us that they had faxed to CIO information related to 33 DUPREF transcripts involving taxpayers in bankruptcy status. However, during our subsequent visit to CIO, we found that either through omission or misplacement of the transmittals, CIO only received information for 26 of the 33 DUPREF cases sent to it by the SCC. Until we brought this matter to their attention, neither CIO nor the originating SCC was aware of the discrepancy. As a result, the 7 DUPREF transcripts that were not received by CIO had not been investigated to determine whether they were valid refund transactions. The IRM requires the review of DUPREF transcripts to minimize the risk of disbursing potentially duplicate or erroneous refunds.[Footnote 38] Although officials at the SCC we visited informed us there is a standard practice followed by the Manual Refund Unit to communicate and confirm to CIO the pertinent taxpayer information taken from the DUPREF transcripts, we found that the practice was not consistently followed. Additionally, there is no specific IRM requirement that CIO acknowledge receipt of the Form 3210 transmittal received from the SCCs or for the SCCs to verify that all of the transmittals they sent were received by CIO. Not reviewing the DUPREF transcripts increases the risk that duplicate or erroneous refunds will not be detected in time to prevent them from being issued or to permit pursuit of effective corrective action, as appropriate. Recommendations: We recommend that you direct the appropriate IRS officials to revise the IRM to require: * CIO to promptly provide service center campuses an acknowledgment of receipt for each Form 3210 transmittal related to a duplicate refund transcript sent to them by a service center campus for review, * service center campuses to verify that an acknowledgment of receipt has been received from CIO for 100 percent of the Form 3210 transmittals related to duplicate refund transcripts they have forwarded to CIO for review, and: * service center campuses to resolve any instances in which an acknowledgment of receipt for a Form 3210 transmittal related to duplicate refund transcripts is not received. IRS Comments and our Evaluation: IRS agreed with our recommendations and stated that it would update the IRM (1) by December 31, 2010, to require acknowledgment of duplicate refund transcripts to the issuer, (2) by January 31, 2011, to require service center verification of duplicate refund transcript acknowledgments received from CIO, and (3) by January 31, 2011, to include procedures for follow-up and resolution of non-receipt of acknowledgment of duplicate refund transcripts from CIO. We will verify the changes to the IRM and evaluate the effectiveness of IRS's efforts during future audits. Lockbox Bank Transmittals: During our fiscal year 2009 financial audit, we found that the quantity of the unprocessable items with receipts shipped from lockbox banks differed from what the SCCs actually received. IRS defines unprocessable items as any document, correspondence, or item that cannot be processed by the lockbox bank. For example, unprocessable items with receipts can include any tax return or document with unacceptable forms of payment such as traveler's checks, gold coins, and other items of value that are easily negotiable. Lockbox banks complete a transmittal form for the daily shipment of unprocessable items with receipts sent to SCCs for further processing. This form provides an inventory of the items and quantities in the shipment. However, we observed the shipping and receiving of these packages and noted that two SCCs we visited were not sending acknowledgment of the items received to the lockbox banks, including instances when there were discrepancies between the quantity of unprocessable items the lockbox bank recorded on the transmittal form and the quantity of unprocessable items the SCC actually received. Because these may contain valuable items or sensitive information, it is important that they be carefully tracked to ensure that all of the items shipped were actually received by the recipient. Internal control standards require that agencies establish physical controls to secure and safeguard vulnerable assets, ensure that ongoing monitoring occurs in the course of normal operations, and communicate deficiencies found during monitoring to appropriate levels of management.[Footnote 39] Additionally, the IRM requires IRS to establish a system to track and monitor all shipments of taxpayer receipts and information, which includes unprocessable items with receipts, to ensure accountability for and receipt of each shipment. However, we found that IRS has not established specific requirements for (1) acknowledging unprocessable items with receipts received from lockbox banks, (2) tracking SCC acknowledgments, and (3) monitoring the process used to track and acknowledge transmittals of unprocessable items with receipts, including the timely detection and communication of discrepancies. This increases the risk of error and fraud and, therefore, the potential for loss, theft, and misuse of taxpayer receipts and information. Recommendations: We recommend that you direct the appropriate IRS officials to do the following: * Require service center campuses to acknowledge unprocessable items with receipts received from lockbox banks. * Establish procedures to track service center campus acknowledgments of unprocessable items with receipts. * Establish procedures to monitor the process used by service center campuses and lockbox banks to acknowledge and track transmittals of unprocessable items with receipts. These procedures should include monitoring discrepancies and instituting appropriate corrective actions as needed. IRS Comments and our Evaluation: IRS agreed with our recommendations and stated that it would implement procedures by December 31, 2010, to (1) revise the lockbox document transmittal form and draft instructions to include acknowledgment from the service center campus, (2) conduct training and instructions on this process, and (3) update the lockbox data collection instrument to include tracking and monitoring adherence to, and implementation of, corrective actions. We will review IRS's implementation of its new procedures and monitor their effectiveness during future audits. Security Reviews at Service Center Campuses and Field Offices: During our fiscal year 2009 financial audit, we found that physical security analysts at the SCC and field office locations we visited did not always accurately assess the physical security and emergency preparedness controls in place. We previously recommended that IRS improve its internal controls related to physical security at its processing facilities and field offices to include (1) performing and documenting the testing of its alarms, (2) maintaining documentation on contractor background investigations to ensure that background investigations are completed, (3) improving surveillance camera coverage of the perimeter and fence line at SCCs, and (4) conducting periodic reviews of the Emergency Signal History Reports and emergency contact lists to ensure that appropriate individuals are contacted during emergencies.[Footnote 40] One of the tools that IRS developed to address our recommendations was the Physical Security and Emergency Preparedness audit management checklist. IRS physical security analysts at SCCs and field offices are responsible for completing the checklist, which includes steps to test controls for limiting and controlling building access, review security guards' training records and performance requirements, and validate that surveillance cameras and other related equipment are properly operating. During our audit, we reviewed completed checklists for two SCCs and nine field offices we visited and found that the information on five of the completed checklists did not correspond to our own observations and test results. For example, at three field offices, the completed checklists indicated that surveillance cameras were not used or applicable for those locations. However, based upon our physical observations and inquiries we found that surveillance cameras were used at all three of these locations. Also, at one SCC and two field offices we visited, the physical security analysts asserted on the checklists that they had performed the required quarterly (1) reviews of the duress alarm emergency contact list provided to the central monitoring station and (2) tests of alarms at the SCC. However, after further discussion and review of documentation provided by the physical security analysts, we found that these reviews had not been performed. In one instance, the alarms had not been tested in nearly a year. Internal control standards require physical controls to limit access to vulnerable assets and require that access to resources and records, such as IRS receipts and taxpayer information, be limited to authorized individuals to reduce the risk of unauthorized use or loss to the government.[Footnote 41] The standards further state that control evaluations, such as reviews of control design and tests of internal control, are useful because they focus directly on the controls' effectiveness at a specific time. These evaluations should be accurately and promptly recorded to maintain their relevance and value to management in controlling operations and making decisions. Deficiencies found during such evaluations should be communicated to individuals at least one level of management above the individual performing the evaluation. However, by entering inaccurate information on the checklists regarding the status of controls, physical security analysts failed to provide management with reliable information needed to assess the effectiveness of physical security controls at these locations. In particular, misrepresenting or overstating the adequacy of physical security controls increases the risk that IRS management will not timely detect control deficiencies and thus may fail to adequately restrict access to taxpayer receipts and information. Although IRS issued the checklist to assist with the identification, prevention, and reduction of physical security weaknesses, we found, based on discussions with physical security analysts and our own observations, that several questions in the checklist were unclear and that no detailed guidance or training was provided to assist in completing the checklist questions. For example, the checklist is used to assess physical security controls at all IRS facilities, including SCCs, computing processing centers, and field offices, and certain questions on the checklist are specific to a particular type of facility. However, during the discussions with the physical security analysts, we found that they were unable to clearly discern which questions were relevant to a specific facility. We also found that several physical security analysts were unsure how to adequately assess or perform certain security reviews on the checklist, such as verifying that all duress alarms are functioning properly. These analysts were unsure because they were not trained on the various components and structure of the security system. As a result of these issues, the analysts were unsure how to properly assess the respective physical security controls. In addition, there were no instructions (1) informing the physical security analysts how often the checklists should be completed at each IRS facility and (2) requiring supervisors or managers to perform and document reviews of the checklist to validate the physical security analysts' responses. By not providing sufficient guidance and training for completing the checklists, IRS cannot be assured that the checklists will assist in accurately assessing the security posture of SCC and field office locations, and identifying actual or potential physical security issues so that corrective actions can be taken. This, in turn, increases the risk that weaknesses in controls designed to secure and safeguard vulnerable assets will go unnoticed, and IRS will not promptly detect or prevent the theft or loss of, or unauthorized access to, taxpayer receipts and information. Recommendations: We recommend that you direct the appropriate IRS officials to do the following: * Review the audit management checklist for clarity and revise the assessment questions as appropriate. * Issue written guidance to accompany the audit management checklist that explains the relevance of the questions and the methods that should be used to assess and test the related controls. * Provide training to physical security analysts responsible for completing the audit management checklist to help ensure that checklist questions are answered appropriately and accurately. * Establish and document the minimum frequency for how often the audit management checklist should be completed at each service center campus and field office. * Establish policies requiring documented managerial reviews of completed audit management checklists. These reviews should document (1) the time and date of the review, (2) the name of the manager performing the review, (3) the supporting documentation reviewed, (4) any problems identified with the responses on the checklists, and (5) corrective actions to be taken. IRS Comments and our Evaluation: IRS agreed with our recommendations and stated that it has incorporated instructions for completing the audit management checklist in its December 18, 2009 revision of the checklist and documented the frequency for completing the checklist. In addition, IRS stated that by July 30, 2010, it would modify its procedures for documenting management review of the audit checklists to include the time and date of the review, the name of the manager performing the review, the supporting documentation reviewed, and any problems identified. IRS stated it would also review the audit management checklist questions for clarity by December 30, 2010, and provide training on completing the checklist by December 31, 2010. We will review IRS's changes and evaluate the effectiveness of IRS's efforts during our audit of IRS's fiscal year 2010 financial statements and future audits. Oversight Controls at Taxpayer Assistance Centers: During our fiscal year 2009 financial audit, we found that TAC group managers did not always accurately assess the status of operational and security controls at IRS's TACs. IRS's Field Assistance Office, which oversees the TAC program, implemented the TAC Security and Remittance Review Database (TSRRD) to monitor each TAC's adherence to specific operational and security controls designed to collect, process, and safeguard taxpayer receipts and information. TAC group managers, who are responsible for managing the day-to-day operations at these TACs, conduct quarterly reviews to assess the effectiveness of these procedures and controls and enter the results of their reviews into the TSRRD. Field Assistance headquarters management uses the TSRRD to track the progress of corrective actions addressing weaknesses identified during operational reviews and to monitor prior audit findings. During our fiscal year 2009 audit, we visited nine TACs and identified several instances where responses entered by TAC group managers into the TSRRD were inaccurate and, as a result, did not meet Field Assistance's oversight objectives of monitoring operational and security controls at these locations. Specifically, we found the following. * At two TACs we visited, the group managers' assessments of controls over the transmission of taxpayer receipts and information to the SCC were not always accurate. For example, at these TACs, the respective group manager indicated in the TSRRD that TAC staff reconciled payments to the document transmittal forms prior to mailing them to the SCC.[Footnote 42] However, after further discussions and review of the documentation provided by the group managers, we determined that this was not being performed at these TAC locations. * At two other TACs we visited, the group managers incorrectly assessed controls for receiving and recording cash payments. These locations were exempt from receiving cash payments; however, the TSRRD indicated that appropriate controls were in place for receiving cash payments and operating as designed. * At one of the TACs we visited, the group manager indicated that duress alarms at the location were routinely tested. However, after we reviewed the alarm history report from the monitoring company, we determined that this was not the case. * At another TAC we visited, the group manager indicated that cleaning contractors were only allowed access to the IRS space during operating hours while other IRS employees were present. However, in conducting our own observations, we found that these contractors were allowed access during nonoperating hours. In attempting to reconcile the differences between our own observations and test procedures and the results of the group managers' quarterly reviews as indicated in the TSRRD, we found that several questions in the TSRRD were unclear and as a result, group managers were unsure how to properly assess the related controls. We asked several group managers to explain their interpretation of a few questions included in the database and we received varying responses. We also found that there was no policy in place requiring that responses entered by the group managers be reviewed and validated by territory managers or area directors before being forwarded to Field Assistance office headquarters management.[Footnote 43] Because several assessment questions in the TSRRD were unclear and IRS did not provide sufficient guidance or training for completing the TSRRD or require a supervisory review or validation of the information entered into it, the information used by headquarters management to make decisions and evaluate TAC adherence to control safeguards was not accurate, and therefore, not effective for decision making. Internal control standards require physical controls to limit access to vulnerable assets and require that access to resources and records, such as IRS receipts and taxpayer information, be limited to authorized individuals to reduce the risk of unauthorized use or loss to the government.[Footnote 44] The standards further state that control evaluations, such as reviews of control design and tests of internal control, are useful because they focus directly on the controls' effectiveness at a specific time. These evaluations should be accurate and promptly recorded to maintain their relevance and value to management in controlling operations and making decisions. Deficiencies found during such evaluations should be communicated to individuals at least one level of management above the individual performing the evaluation. Inaccurate information on the status of controls entered by TAC group managers into the TSRRD, combined with the lack of a review and validation of this information, impaired IRS management's ability to have reliable information concerning the status of certain controls at these TAC locations. In particular, overstating the adequacy of internal controls increases the risk that IRS management will not promptly detect operational or control deficiencies and thus may fail to implement adequate controls to reduce the risk of theft or loss of, or unauthorized access to, taxpayer receipts and information. Recommendations: We recommend that you direct the appropriate IRS officials to do the following: * Review the TSRRD for clarity and revise review questions as appropriate. * Provide training to TAC group managers to assist with their understanding of the TSRRD review questions and related objectives. This training should be provided on an ongoing basis to account for changes in TSRRD questions and for newly hired or appointed TAC group managers. * Establish policies that require territory managers or a manager at least one level above the group manager to periodically review the information entered into the TSRRD for accuracy and completeness prior to the results being forwarded to Field Assistance Office headquarters management. This review should be signed and documented, and include (1) the time and date of the review, (2) the name of the manager performing the review, (3) the task performed during the review, (4) any problems or questions identified, and (5) planned corrective actions. IRS Comments and our Evaluation: IRS agreed with our recommendations and stated that it would, by January 31, 2011, clarify and revise the TSRRD review questions and add instructions to the IRM. In addition, IRS stated that by March 31, 2011, it would (1) conduct training and include TSRRD training in its Filing Season Readiness Workshop DVD delivered to all group managers annually and (2) update its policy to include instructions for the Field Assistance territory manager, or a manager one level above, to review the frontline manager's completed TSRRD responses and planned corrective actions. We will evaluate the effectiveness of IRS's efforts during future audits. Security Awareness Training: During our fiscal year 2009 financial audit, we found that IRS did not require that all SCC and field office contractors who are provided routine, unescorted, unsupervised physical access to IRS facilities containing taxpayer receipts and information undergo annual security awareness training. According to IRS, security awareness training is an essential management tool used to educate its employees on (1) authorized and unauthorized disclosures of taxpayer information, (2) basic protection policies concerning taxpayer receipts and information, and (3) federal penalties for not protecting this information. However, we found that janitors and security guards were all granted access to these facilities but were either not required to meet or were exempt from annual security awareness training requirements. During our discussions with IRS officials, we were informed that only contractors involved in the development, operation, or support of IRS's information systems are covered under the security awareness training requirement. However, other contractors, such as janitors and security guards, are allowed to freely enter areas throughout the SCC, where taxpayer receipts and sensitive information are processed and stored, to perform their contractual duties. Such unfettered access without corresponding training on the responsibilities associated with such access increases the risk of unauthorized disclosures of taxpayer information and loss or theft of taxpayer receipts. Internal control standards require that agencies establish controls to safeguard vulnerable assets and implement access restrictions to and accountability for resources and records, including taxpayer receipts and information.[Footnote 45] The IRM establishes requirements for managers and employees to complete security awareness training in order to ensure that employees are aware of proper safeguarding controls over taxpayer receipts and information. However, the IRM does not require that all contractors with physical access to IRS facilities receive security awareness training, thus increasing the vulnerability of taxpayer receipts and data to improper disclosure or loss. The effectiveness of IRS's security awareness training program, which is intended to help protect taxpayer information, is impaired if contractors with physical access to taxpayer receipts and information are not educated and briefed on these principles. Recommendation: We recommend that you direct the appropriate IRS officials to analyze the various contractor access arrangements and establish a policy that requires security awareness training for all IRS contractors who are provided unescorted physical access to its facilities or taxpayer receipts and information. IRS Comments and our Evaluation: IRS agreed with our recommendation and stated that it would develop a policy requiring security awareness training for all IRS contractors who are provided unescorted physical access to its facilities or taxpayer receipts and information by June 30, 2011. We will verify IRS's development and implementation of the new policy during future audits. Unit Security Representative Training: During our fiscal year 2009 financial audit, we found that SCC Unit Security Representatives (USR), who are responsible for system security over one of IRS's key tax processing systems, did not always receive or timely complete the required USR initial training and did not always complete annual USR refresher training. USRs perform important security duties for IRS's Integrated Data Retrieval System (IDRS), which is one of the key systems IRS uses to process taxpayer data,[Footnote 46] and the training covers how they should carry out these duties in order to properly fulfill their security obligations. For example, USRs are responsible for monitoring each IDRS user's access codes, updating user profiles for changes in access rights, issuing temporary passwords, and reviewing security reports and taking appropriate action to address security weaknesses and breaches. Therefore, it is essential that they be properly trained on how to perform these critical responsibilities. However, we reviewed the employee profiles of 10 USRs at one SCC and found that none of the 10 had received initial training prior to performing their duties. Moreover, only 5 of the 10 USRs had completed annual refresher training as required by the IRM. We also reviewed employee profiles of 10 USRs at a second SCC and found that 1 of the 10 did not complete required initial training prior to performing USR duties. Additionally, we found the training materials used for USR annual refresher training at the first SCC referenced obsolete policies and procedures and thus, had not been updated to reflect current requirements. Internal control standards state that a key factor that affects the control environment is management's commitment to competence.[Footnote 47] All personnel need to possess and maintain a level of competence that allows them to effectively accomplish their assigned duties, as well as understand the importance of developing and maintaining effective internal control. Management needs to identify appropriate knowledge and skills needed for various jobs and provide the staff assigned to these positions the training necessary to enable them to effectively fulfill their assigned responsibilities. The IRM requires that USRs must complete initial USR training prior to performing their duties and complete annual USR refresher training.[Footnote 48] It also requires IDRS security officers to train and work with USRs to maintain the desired level of IDRS security and conduct USR training sessions at least annually.[Footnote 49] The lack of initial training and incomplete annual refresher training occurred at the first SCC because the IDRS Security Officer responsible for providing USRs with training had not done so. There were approximately 300 USRs at this SCC and according to the IDRS Security Officer Assistant, none of them were provided initial training because the IDRS Security Officer responsible for providing the training had been too busy with other responsibilities. In addition, the training manual used for the annual refresher training was provided by Mission Assurance and Security Services and, even though it contained obsolete information, was the most current version available. At the second SCC, the IDRS Security Officer informed us she had overlooked the USR who did not receive initial training prior to performing USR duties. Although the IRM requires that Division Commissioners, Chiefs, and the Taxpayer Advocate ensure that the USRs complete the required USR initial and annual refresher training, the requirement does not clearly designate an individual with the oversight and enforcement responsibility.[Footnote 50] The lack of required USR initial and annual refresher training for USR staff performing critical IDRS security functions coupled with outdated training materials increases the risk that USRs may not adequately perform their security duties. This, in turn, increases the risk of unauthorized access to the IDRS data. Recommendations: We recommend that you direct the appropriate IRS officials to do the following. * Designate management responsibility and establish a process for monitoring compliance with and enforcing the IRM requirement for all USRs to complete (1) the required initial USR training prior to assuming their responsibilities, and (2) annual refresher training each year thereafter. * Update USR training manuals to ensure they reflect current security policies and procedures. * Establish a process to periodically review and update training materials as appropriate. IRS Comments and our Evaluation: IRS agreed with our recommendations to monitor and enforce compliance with its USR training requirements and update training materials. IRS stated that it (1) required all USRs and alternate USRs to take an initial training class by May 31, 2010, (2) launched two new online training courses to provide initial and annual refresher training to all USRs, (3) would implement a report to monitor compliance with USR training requirements by December 31, 2010, and (4) implemented an annual review and update of the IDRS USR training material in December 2009 with another update planned by December 31, 2010. We will review IRS's new training requirements and evaluate the effectiveness of IRS's efforts during our audit of IRS's fiscal year 2010 financial statements and future audits. Annual Mandatory Briefings: During our fiscal year 2009 financial audit, we found that IRS's employees did not always complete their annual mandatory briefing requirements in fiscal years 2008 and 2009.[Footnote 51] IRS's learning and education policy requires all employees to complete certain mandatory briefings each year in areas such as ethics and information security.[Footnote 52] We reviewed the training records of a non-statistical selection of 93 employees and found that 7 of the 93 employees did not complete all mandatory briefings in fiscal year 2008 and at least 1 of the 93 employees did not complete all of the mandatory briefings required for fiscal year 2009. We were not able to conclude on 7 of the 93 employees for fiscal year 2009 at the time of our audit because they worked for business units that allowed their employees up to 8 months after the end of the fiscal year to complete the briefings.[Footnote 53] Internal control standards require all personnel to possess and maintain a level of competence that allows them to accomplish their assigned duties, as well as understand the importance of developing and implementing good internal control.[Footnote 54] This is one of several factors that affect the control environment, which provides discipline and structure, as well as the climate which influences the quality of internal control. In addition, the standards state that management should ensure that skill needs are continually assessed and that the organization is able to obtain a workforce that has the required skills that match those necessary to achieve organizational goals. Training should be aimed at developing and retaining employee skill levels to meet changing organizational needs. The majority of IRS employees take the briefings online through its Enterprise Learning Management System (ELMS).[Footnote 55] Each business unit establishes its own process for ensuring that employees receive mandatory briefings within required time frames. To help monitor compliance with the briefing requirements, ELMS administrators in each business unit generate a standard report listing the employees who have not yet completed the mandatory briefings and follow their business unit's procedures for documenting incomplete training. Each business unit's manager is responsible for ensuring that business unit employees complete the required briefings; however, they generally leave it up to the individual supervisor to notify his or her employees to complete the mandatory briefings by the cut-off date. The Director of IRS's Human Capital Office, Leadership, Education and Delivery Services (HCO LEADS) organization maintains and administers policy and guidelines for servicewide learning and education, but does not oversee or review each business unit's process or results to ensure mandatory briefing requirements are met. When employees fail to attend mandatory briefings, they may lack the necessary skills to successfully perform their assigned duties. Recommendation: We recommend that you direct the appropriate IRS officials to establish procedures requiring HCO LEADS or their designee to periodically monitor each business unit's progress in complying with mandatory briefing requirements. IRS Comments and our Evaluation: IRS agreed with our recommendation and stated that it would provide each business unit with reports on the unit's progress in complying with the mandatory briefings requirement. In addition, IRS stated that by January 31, 2011, it will begin distributing quarterly summary reports to heads of offices. We will evaluate the effectiveness of IRS's efforts during our audit of IRS's fiscal year 2010 financial statements and future audits. Documentation of Receipt of Goods and Services: During our fiscal year 2009 financial audit, we found that IRS staff did not always confirm, or obtain documentation of confirmation, with the end user of a purchased product or service that the item was satisfactorily received before entering receipt and acceptance of the good/service into the procurement system. This confirmation is essential because in many instances, the end user of the product (i.e., the requestor who physically receives the good or service) is at a different geographic location than the staff member responsible for entering receipt and acceptance into the system. As a result, without following up with the end user, the staff cannot ensure that the good or service met contractual requirements before authorizing payment to the vendor. All purchase requisitions that go through IRS's procurement department are assigned to a contracting officer (CO).[Footnote 56] A contracting officer may assign a contracting officer's technical representative (COTR) to perform certain tasks, including maintaining documentation of the receipt and acceptance (R&A) of purchased goods or services in the Web Request Tracking System (WebRTS), IRS's procurement system. [Footnote 57] Staff use this system to create, route, approve, track, and fund requisitions, and record the receipt and acceptance of the items purchased. Receipt signifies IRS's acknowledgment that supplies were received or services were rendered, while acceptance signifies that IRS assumes ownership of the supplies or approves of the services rendered. Consequently, prior to entering R&A into WebRTS, the CO/COTR is to ensure the good or service conforms to the contract requirements. In addition, IRS's accounting technicians who process payments rely on the assertion of the COs/COTRs that goods or services have been received and accepted as a basis for authorizing payment. However, we found that the CO/COTR did not always confirm or obtain documentation of confirmation of receipt from the end user prior to entering R&A in WebRTS. Specifically, we tested a statistical sample of 116 nonpayroll expense transactions processed between October 1, 2008, and May 31, 2009, and found that for 5 of the 116 transactions,the COTRs could not provide documentation showing they had confirmed that the end users received and accepted the goods or services before the COTRs entered R&A into WebRTS.[Footnote 58] In 4 cases, the COTRs did not have any documentation from the end users showing that they confirmed receipt of the goods or services with the end users. In the fifth case, the COTR's documentation showed she did not request confirmation of receipt from the end user until the day after she had entered R&A into WebRTS. IRS Policy and Procedures Memorandum No. 46.5 for Receipt, Quality Assurance, and Acceptance states that receipt is defined as the documentation of acknowledgment that supplies were received or services were rendered. This policy also instructs the CO/COTR to maintain documentation of receipt and to acknowledge receipt in WebRTS. However, the policy does not specifically instruct the CO/COTR to obtain and document confirmation from the end user that the good or service was satisfactorily received before entering receipt and acceptance in WebRTS. Internal control standards require that agencies establish control activities that ensure management's directives are enforced and carried out.[Footnote 59] In addition, the standards require that internal control and all transactions and other significant events be clearly documented, the documentation be readily available for examination, and all documentation and records be properly managed and maintained. By not requiring the CO/COTR to obtain and document confirmation that the end user actually received the good or service before entering R&A, an individual may enter an invalid R&A into WebRTS, which could result in an incorrectly recorded expense and the issuance of invalid payments to contractors for goods or services that were not received or did not fully conform to contractual requirements. Recommendation: We recommend that you direct the appropriate IRS officials to establish procedures requiring COs/COTRs to obtain and retain written documentation from end users confirming receipt and acceptability of purchased goods or services prior to entering acknowledgment of receipt and acceptance in WebRTS. IRS Comments and our Evaluation: IRS agreed with our recommendation and stated that it has updated its receipt and acceptance handbook and procurement policies to include the requirement to obtain and retain documentation acknowledging receipt and acceptance of purchased goods and/or services before entering the acknowledgment in WebRTS. In addition, IRS stated that it reinforced this policy during its procurement and CFO customer conferences in March and May 2010. We will evaluate the effectiveness of IRS's efforts during our audit of IRS's fiscal year 2010 financial statements. Review of Obligations: During our fiscal year 2009 financial audit, we found that IRS's controls over the review of obligations did not always ensure the timely deobligation or revision of excess obligations that were no longer needed. Obligations are appropriated funds that have been reserved to purchase specific goods or services specified in a legally binding agreement, such as a contract or a purchase order. Most of IRS's appropriated funds are available for obligation for a fixed period of time and amount. Once obligated, the funds cannot be used to fund the purchase of new goods or services unless the obligated funds are deobligated from one purchase, reobligated to another, and still within their valid time limits and other appropriations requirements. [Footnote 60] For this reason, it is in IRS's best interest to maximize the use of its appropriated funding by closely managing its obligations to identify funds that are no longer needed under the original obligation that can thus be used to fund other requirements before such funding expires and is no longer available for new obligations. During our testing of undelivered orders and nonpayroll expenses, we found one instance totaling nearly $141,000 and another instance totaling over $62,000 in which IRS did not timely deobligate the obligated funds, even though all items under the related contracts had been delivered and the excess obligated funds were no longer needed. In the first instance, IRS had contracted for temporary clerk services through the end of January 2009. The actual cost of the services was less than the funds obligated, resulting in a remaining obligated balance after the contract period had been completed. IRS did not identify the funds for deobligation until we informed IRS officials approximately 7 months after the final R&A. In the second instance, IRS had contracted for operations support services through December 2008. Final payment for services on this contract was made in February 2009; however, this obligation was not promptly deobligated because the COTR did not mark in WebRTS during final R&A that the February payment was the final payment under the contract. Marking this transaction as the final payment would have indicated that excess obligated funds should be deobligated. After we identified this open obligation during our testing, IRS deobligated the funds. This occurred approximately 6 months after the final payment had been made. [Footnote 61] If the excess obligated funds associated with these two instances had not been deobligated, IRS would have overstated its "Obligations Incurred" and "Obligated Balance" financial statement line items by over $203,000 each. In addition, when excess obligated funds are not deobligated in a timely manner, it can affect whether and how those funds can subsequently be used. Appropriations are generally available for incurring new obligations for a fixed period of time, usually 1 or 2 fiscal years.[Footnote 62] Once this period of availability expires, the funds can only be used for a period of time to adjust previous obligations--such as when the final bills on a contract obligated in a prior year exceed the amount originally obligated--but cannot be used on new obligations or purposes.[Footnote 63] For example, in the instance related to the contract for operations support services described above, the contract was funded by a 2-year appropriation that expired on September 30, 2009. Although final payment was made on the contract in February 2009, IRS did not deobligate the funds until August 2009, after we identified the error and brought it to IRS's attention. Had IRS not corrected the error before September 30, 2009, it would have forfeited its ability to use the excess funds on any new purchases.[Footnote 64] To help facilitate the timely management of obligations, IRS performs its Aging Unliquidated Obligation reviews, which are periodic reviews of obligations that meet certain aging criteria.[Footnote 65] However, during fiscal year 2009, these reviews were not fully effective in timely detecting obligations requiring deobligation. Based on the aging criteria for the periodic reviews, both instances we identified would not have been selected for review until 300 days (about 10 months) after the last activity, which would have been in fiscal year 2010. Consequently, this review has limited effectiveness in assisting IRS in timely identifying funds for deobligation and for use in funding other valid agency needs. Additionally, this review has limited effectiveness in helping to ensure that only valid obligations are reported in IRS's general ledger and, ultimately, its financial statements. The IRM requires the timely management of obligations in order to enable IRS to optimize its financial resources.[Footnote 66] Timely deobligations of unneeded funds allow IRS to use those funds to pay for other goods or services for which the appropriation is available to fund, resulting in maximizing the use of the funds. Furthermore, internal control standards require that transactions and other events be accurately and promptly recorded to maintain their relevance and value to management in controlling operations and making decisions.[Footnote 67] As a result of these internal control deficiencies, IRS may not be maximizing the use of its available funds to meet its mission and is potentially reporting excess obligation amounts in its general ledger accounts and financial statements. Recommendations: We recommend that you direct the appropriate IRS officials to do the following. * Reiterate IRS's policy for staff to indicate in WebRTS during final receipt and acceptance that the payment is a final payment to close out a contract or purchase order to help ensure any remaining obligated funds are deobligated in a timely manner. * Reevaluate and, as necessary, revise the aging criteria for the Aging Unliquidated Obligation reviews so that unliquidated obligations are reviewed sooner in order to detect and deobligate excess obligations in a timely manner. IRS Comments and our Evaluation: IRS agreed with our recommendations and stated that it has revised the aging criteria for the fiscal year 2010 Aging Unliquidated Obligation reviews from 300 days to 240 days, and began issuing quarterly email broadcasts to all WebRTS users in June 2010 to reinforce the use of the receipt and acceptance final flag to ensure timely closure of obligations. While decreasing to 240 days (about 8 months) is an improvement, it is not clear whether this will alleviate the problem. For example, the two transactions we identified had no activity for 6 and 7 months respectively, and thus would not have been subject to the aging unliquidated obligation review had this been the criteria in place at the time. We will evaluate the effectiveness of IRS's efforts during our audit of IRS's fiscal year 2010 financial statements. Recording of Upward and Downward Adjustments to Prior-Year Obligations: During our fiscal year 2009 financial audit, we found that IRS did not always ensure that upward and downward adjustments of prior-year obligations were properly recorded for financial statement reporting purposes.[Footnote 68] To better identify and report only valid upward and downward adjustments of prior-year obligations, IRS performs a monthly netting process on all obligation transactions. The netting process should combine or net transactions primarily with the same obligation number and fund number to eliminate or offset transactions that are accounting corrections and not true adjustments to obligations.[Footnote 69] This netting process should result in a group of transactions that represent only true upward and downward adjustments of prior-year obligations that can be reported on IRS's financial statements. It is important that all valid adjustments and only valid adjustments of prior-year obligations remain after the netting process because upward and downward adjustments are each reported on different line items on the financial statements. In our testing of a statistical sample of 16 downward adjustments as of August 31, 2009, a valid upward adjustment totaling over $28,000 and a valid downward adjustment totaling over $1.4 million were erroneously netted together and could have resulted in the understatement of upward and downward adjustments of prior-years obligation balances reported in the "Obligations Incurred" and "Recoveries of Prior Years Obligations" line items in IRS's statement of budgetary resources, one of the basic agency financial statements. [Footnote 70] The error we found involved two valid (one upward and one downward) adjustments with two different obligation numbers. Normally, IRS's netting process would not combine two transactions with different obligation numbers. However, these two transactions were inappropriately netted because an IRS staff member had erroneously linked the obligation numbers of the two transactions in IRS's accounting system. After we brought this matter to its attention, IRS corrected this error by removing an erroneous obligation number link between the two transactions which caused the improper netting activity. Once the erroneous link was removed, the two valid transactions were reported correctly in the upward and downward adjustments of prior-year obligation accounts. IRS officials stated that it had two reports that are designed to identify linked transactions for further review. However, after further research, IRS determined that neither of these two reports was designed to capture the type of erroneous manual link we identified. IRS officials stated that they are currently developing a new control with the ability to identify situations such as the one we identified so they can be reviewed and corrected if necessary. The IRM requires financial plan managers to make every effort to ensure that data are accurately recorded.[Footnote 71] Furthermore, internal control standards require that transactions and other events be accurately and promptly recorded to maintain their relevance and value to management in controlling operations and making decisions. [Footnote 72] Control activities also help to ensure that transactions are completely and accurately recorded. Because IRS did not have effective controls in place to ensure that the netting process was properly executed or to review the netting process results for such errors, the upward and downward adjustment balances would have been misstated in the financial statements had we not identified and brought the error to IRS's attention. Recommendations: We recommend that you direct the appropriate IRS officials to do the following: * Provide technicians and supervisors who are responsible for recording and reviewing obligation transactions with training on the proper use of manually linked obligation transactions to reinforce IRS's existing policy requiring that transactions be recorded accurately to the upward and downward adjustments of prior-year obligation accounts. * Develop controls to improve the linked obligation transaction review process to detect and correct erroneous links between unrelated upward and downward adjustments of prior-year obligation transactions in a timely manner. IRS Comments and our Evaluation: IRS agreed with our recommendations and stated that it (1) revised its process for manually linking obligations, updated the related procedures, and provided additional training to technicians and supervisors in October 2009 and (2) revised its processes in March 2010 to include a second level review of all linked obligations at the time of the actual linking. We will review the updated policies and procedures and evaluate their design and operating effectiveness during our audit of IRS's fiscal year 2010 financial statements. Compliance with Appropriations Act Requirements: During our fiscal year 2009 financial audit, we found that IRS did not comply with all requirements of its annual appropriations act. IRS's fiscal year 2009 appropriations act required IRS to set aside at least $7.487 billion for tax law enforcement and related support activities. [Footnote 73] The appropriations act funded five separate appropriations accounts, including accounts for taxpayer services, enforcement, and operations support; however, the amount appropriated to the enforcement account alone was insufficient to satisfy the set- aside requirement. Consequently, IRS was required to identify additional funds from among the other four accounts and make available for obligation solely to tax law enforcement and related support activities the amount necessary to meet the requirement. However, at the end of our fiscal year 2009 audit, IRS asserted to us that it had set aside only $7,413,237,071 for tax law enforcement and related support activities, resulting in a shortfall of about $73.8 million in amounts set aside for these activities. IRS officials attributed this shortfall to three causes. First, the federal government was operating under a continuing resolution for almost half of the fiscal year which, according to IRS, delayed it from hiring staff needed for some of its enforcement initiatives. [Footnote 74] Consequently, fewer enforcement staff were on board throughout the year than originally estimated. Second, IRS initially estimated it would allocate about $5.1 billion in direct enforcement costs from its enforcement appropriations account and about $2.4 billion in indirect enforcement costs from its operations support appropriations account to meet the appropriations act's requirements. IRS budget officials stated that they estimated the portion of operations support appropriations--which are available to support both IRS's taxpayer services and enforcement programs--that would be allocated to enforcement activities based on IRS's fiscal year 2009 budget request. However, these officials stated that increased fiscal year 2009 funding received for taxpayer services,[Footnote 75] when coupled with the delayed hiring in enforcement, resulted in a greater portion of its operations support costs being allocated to the taxpayer services program and consequently less to the enforcement program than originally estimated.[Footnote 76] Third, IRS had about $70.6 million in fiscal year 2009 operations support appropriations that were unobligated at the end of the fiscal year. Because these funds had not yet been obligated and therefore allocated to programs, none of these funds were counted toward the set-aside requirement. However, even if IRS could have allocated all of these unobligated operations support funds to enforcement, that would only have reduced, but not eliminated, the amount of the shortfall. We recognize that the continuing resolution and the late passage of its appropriations act put IRS in a difficult position. In particular, we can appreciate that this would have had a negative effect on hiring. However, these challenging circumstances did not eliminate IRS's requirement to comply with all provisions in its annual appropriations act and to establish adequate funds control procedures to provide reasonable assurance of compliance. In preparation for this report, we discussed our concerns with IRS budget officials in February 2010. In April 2010, IRS officials presented us with a revised tax enforcement analysis, which asserted that IRS was now in compliance with the fiscal year 2009 set-aside requirement. In its revised analysis, IRS did not change the amount of appropriations that it allocated to the set-aside amount from the enforcement appropriations account; however, IRS increased the amount of operations support appropriations allocated to its enforcement program by $98.4 million. As a result, IRS's revised analysis reflected total appropriations allocated to tax law enforcement and related support activities of $7,511,675,000, which would have exceeded the set-aside requirement by $24.7 million. We reviewed IRS's revised analysis and found problems with the methodology that IRS used to support its claim that it now complied with its appropriations act requirement. Of the $98.4 million increase in operations support appropriations allocated to tax law enforcement activities, $70.6 million consisted of all of IRS's fiscal year 2009 operations support appropriations that remained unobligated at fiscal year end. IRS, in its revised analysis, attributes all of these unobligated operations support funds to tax law enforcement. We disagree with this methodology because these funds will also support the overhead costs of taxpayer services and other programs; therefore, only a portion of these unobligated operations support funds would truly be used to support tax law enforcement and related support activities. IRS's revised analysis achieves the remaining $27.8 million of the operations support allocation increase by not allocating any operations support costs to taxpayer services activities that were funded with $67.9 million in additional appropriations that were included in the fiscal year 2009 continuing resolution to meet the requirements of the Economic Stimulus Act of 2008.[Footnote 77] IRS officials stated that because this was a special appropriation, no operations support costs should be allocated to it. We disagree with this reasoning because the staff and activities funded by this special appropriation still required the use of office space, information technology, and other support services that are funded by the operations support appropriations account. By not allocating any operations support costs to these taxpayer services activities, IRS is erroneously allocating operations support costs, which actually supported its taxpayer services program, to its enforcement program. In addition, the set-aside requirement in IRS's fiscal year 2009 appropriations act required IRS to make available the entire set-aside amount for obligation. Since some of the funds IRS included in its revised analysis expired at the end of fiscal year 2009, reallocating and setting aside such appropriations after the end of the fiscal year fails to satisfy this requirement. IRS's failure to comply with its appropriations act requirement can be attributed in large part to a lack of internal controls to monitor and ensure compliance with its appropriations act requirements. In particular, IRS had established no formal funds control processes to clearly set aside the required funds. IRS officials stated that they have the ability to create a report to track the status of the tax law enforcement obligations and related monthly operations support allocations throughout the year; however, they stated they do not have any written policies or procedures specifying how compliance with such appropriations act requirements will be monitored and achieved. Without adequate internal controls to monitor progress against its appropriations act requirements and to take action to comply with these requirements, IRS may not have reasonable assurance that it is complying with all of its appropriations act requirements. IRS initially informed us that it would have had to transfer appropriations from nonenforcement appropriations accounts, such as the operations support account, to the enforcement appropriations account in order to comply with the tax law enforcement requirement. IRS's fiscal year 2009 appropriations act allows IRS to transfer up to 5 percent of any nonenforcement appropriation made available in the fiscal year 2009 appropriations act to its enforcement appropriation account upon the advance approval of the Committees on Appropriations.[Footnote 78] Although IRS officials informed us that they knew in the middle of fiscal year 2009 that they were not likely to meet the set-aside requirement, they did not request such a transfer during fiscal year 2009. Since a similar tax law enforcement requirement has been included in IRS's fiscal year 2010 appropriations act,[Footnote 79] IRS needs to have appropriate funds control policies and procedures in place to ensure it meets its mandated appropriations act requirements.[Footnote 80] Recommendations: We recommend that you direct the appropriate IRS officials to do the following. * Establish a formal funds control process to set aside amounts for tax law enforcement and related support activities, as required by annual appropriations acts. * Establish a policy to periodically monitor throughout the year the amount of different appropriations accounts attributed to the set- aside to assess IRS's progress toward complying with the requirement. * Based on the results of its periodic assessments, take action to allocate the required amount of appropriations to tax law enforcement and related support activities to comply with the set-aside requirement. IRS Comments and our Evaluation: IRS disagreed with all three recommendations related to its compliance with the fiscal year 2009 appropriations act requirements. IRS stated that (1) it fully funded tax law enforcement activities and met the intent of the 2009 legislation; (2) our characterization of the fiscal year 2009 appropriations act was incorrect; (3) it disagreed with our characterization of its April 2010 analysis; and (4) its failure to comply with the appropriations act requirement was not attributable to a lack of internal controls to monitor and ensure compliance. As discussed in the following paragraphs, we disagree with all of these points. First, IRS stated that it fully funded tax law enforcement activities and met the intent of IRS's fiscal year 2009 appropriations act. The act (1) provided $5.12 billion in IRS's enforcement appropriation, which funds direct enforcement activities such as conducting criminal investigations; and (2) required IRS to explicitly make available at least a total of $7.487 billion specifically for enforcement activities from among any of its appropriations funding in the appropriations act. IRS stated that because it obligated most of the funds appropriated for enforcement (the $5.12 billion) and allocated to enforcement a commensurate portion of operations support costs (i.e., the indirect or overhead costs associated with operating IRS's enforcement program),[Footnote 81] it fully funded its enforcement activities and thus met the intent of the law. We disagree. By not explicitly designating appropriated amounts of at least $7.487 billion for enforcement activities, IRS did not comply with the appropriations act set-aside requirement. The fact that IRS elected to meet the set- aside requirement in part through an allocation of indirect costs to enforcement activities does not alter the express requirement in the appropriations act. In fact, as IRS noted in its written response, it requested a change in the appropriations language to make compliance with this requirement contingent upon the availability of funds in its operations support account. IRS stated that this contingency was included in the fiscal year 2010 House Budget Resolution but was not included in the enacted law. We believe that IRS's proposal to amend the requirement provides further evidence that IRS was legally obligated to identify and set aside the $7.487 billion for enforcement activities from among its appropriations accounts. Second, IRS stated that our characterization of the requirements of the fiscal year 2009 appropriations act in our report was incorrect. IRS stated that the act's requirement that it make available $7.487 billion for tax law enforcement and related support activities applies only to the enforcement appropriation and the operations support appropriation. We agree that the $7.487 billion must be used only for tax law enforcement and related support activities. However, as discussed in our report, we disagree that the act provided that the source of funding must come solely from (and therefore is limited to the availability of) enforcement and operations support appropriations. In fact, the act explicitly provided that all of the funds made available by the Act shall be available to meet the requirement.[Footnote 82] Thus, it is clear that compliance was not contingent upon the availability of enforcement and operations support appropriations.[Footnote 83] Third, IRS disagreed with our characterization of the supplemental analysis it provided to us in April which was intended to demonstrate that it complied with the fiscal year 2009 appropriations act requirement. IRS stated that the primary change in the April 2010 analysis from the initial analysis it provided us was to count all unobligated operations support balances towards the amount required, under the assumption that those funds met the criteria that the resources "shall be available" for enforcement activities. However, as IRS stated in its comments, it cannot "set aside" funds in operations support exclusively for enforcement activities. Therefore, it is not possible for IRS under its cost allocation methodology to make 100 percent of the unobligated operations support balances at year end available exclusively for enforcement. In addition, even if IRS could have allocated all of the unobligated operations support balances to enforcement, the $70.6 million in total unobligated operations support balances would not have been enough to make up for the $73.8 million shortfall. Finally, IRS disagreed that its failure to comply with the appropriations act requirement is attributable to a lack of internal controls to monitor and ensure compliance. We can appreciate that the late passage of the final fiscal year 2009 budget and IRS's use of an indirect cost allocation approach to carrying out the set-aside both created difficulties for IRS in managing its appropriations. However, as discussed in our report, additional internal controls in this area could have alerted IRS to the problem much earlier in the year and enabled IRS to take corrective actions that may have enabled it to comply with the appropriation act's requirements. IRS stated that when it developed its fiscal year 2009 budget request, it estimated the amount of direct enforcement and related operations support costs that would enable it to comply. Because IRS must submit its budget request many months before the start of the fiscal year, the actual budget and other circumstances can change drastically before the final appropriation is enacted. Thus, it is important for IRS to establish and implement control procedures to ensure it periodically reassesses its estimates and revises plans as appropriate. However, IRS did not have such controls in place. For example, IRS officials stated that Congress appropriated $143 million more than IRS anticipated to taxpayer services in fiscal year 2009. While IRS's fiscal year 2009 appropriations act was not enacted until March 11, 2009, a significant portion of the increase ($67.9 million) was provided to IRS in its continuing resolution enacted September 30, 2008.[Footnote 84] Consequently, IRS knew about nearly half of the increase at the beginning of the fiscal year, yet it did not reassess its original estimates nor take any action to address the impact that the increase would have on the allocation of operations support costs to its tax law enforcement activities. For instance, rather than depending solely on the allocation of operations support costs to enforcement to meet the requirement, IRS could have identified funding sources in other appropriations or requested a transfer of funds to the direct enforcement appropriation. In addition, IRS's statements that the proportion of operations support costs allocated to the taxpayer service program from the enforcement program increased after the end of the fiscal year are incorrect. Contrary to IRS's assertions, IRS does not allocate the entire year's expenses at the end of the year. IRS runs its cost allocation methodology at the beginning of every month to allocate the prior month's operations support costs to the major programs, including taxpayer services and enforcement. The results of each monthly allocation are then added to the previous month's cumulative totals by program, so that at the end of the year all of the monthly allocations total the amount reported in IRS's statement of net cost. IRS's post year-end allocations only allocate the final month's operations support costs plus year-end adjustments necessary to prepare its financial statements. Had IRS's budget office had effective controls in place to monitor these monthly allocations, it could have tracked the amounts allocated to enforcement against what was originally estimated throughout the year and thus, could have identified early on that action was needed to meet the requirement. For the reasons discussed above, we still believe that IRS did not comply with the requirements of its fiscal year 2009 appropriations act with respect to its requirement that IRS set aside at least $7.487 billion for tax law enforcement and related support activities. IRS recognizes a problem exists, which is why it plans to propose language in its fiscal year 2012 budget request to make compliance with this requirement contingent upon the availability of funds in its operations support account. We also believe that the recommendations we are making in this report, if effectively implemented, will assist IRS in ensuring it has the processes and controls in place to minimize the risk of a reoccurrence of this issue. This report contains recommendations to you. The head of a federal agency is required by 31 U.S.C. 720 to submit a written statement on actions taken on these recommendations. You should submit your statement to the Senate Committee on Homeland Security and Governmental Affairs and the House Committee on Oversight and Government Reform within 60 days of the date of this report. A written statement must also be sent to the House and Senate Committees on Appropriations with the agency's first request for appropriations made more than 60 days after the date of the report. Furthermore, to ensure GAO has accurate, up-to-date information on the status of your agency's actions on our recommendations, we request that you also provide us with a copy of your agency's statement of actions taken on open recommendations. Please send your statement of action to me or Doreen Eng, Assistant Director, at EngD@gao.gov. This report is intended for use by the management of IRS. We are sending copies to the Chairmen and Ranking Members of the Senate Committee on Appropriations; Senate Committee on Finance; Senate Committee on Homeland Security and Governmental Affairs; and Subcommittee on Taxation and IRS Oversight, Senate Committee on Finance. We are also sending copies to the Chairmen and Ranking Members of the House Committee on Appropriations and House Committee on Ways and Means; the Chairman and Vice-Chairman of the Joint Committee on Taxation; the Secretary of the Treasury; the Director of the Office of Management and Budget; and the Chairman of the IRS Oversight Board. The report is available at no charge on GAO's Web site at [hyperlink, http://www.gao.gov]. We acknowledge and appreciate the cooperation and assistance provided by IRS officials and staff during our audits of IRS's fiscal years 2009 and 2008 financial statements. Please contact me at (202) 512- 3406 or sebastians@gao.gov if you or your staff have any questions concerning this report. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in enclosure III. Sincerely yours, Signed by: Steven J. Sebastian: Director: Financial Management and Assurance: Enclosures - 3: [End of section] Enclosure I: Details on Audit Methodology: We are responsible for planning and performing the audit to obtain reasonable assurance and provide our opinion about whether (1) IRS's financial statements are presented fairly, in all material respects, in conformity with U.S. generally accepted accounting principles, (2) IRS management maintained, in all material respects, effective internal control over financial reporting as of September 30, 2009, and (3) IRS's financial management systems substantially comply with financial management systems requirements. We are also responsible for (1) testing compliance with selected provisions of laws and regulations that have a direct and material effect on the financial statements, and (2) performing limited procedures with respect to certain other information accompanying the financial statements. To fulfill our responsibilities as the auditor of IRS's financial statements, we did the following. * We examined, on a test basis, evidence supporting the amounts and disclosures in the financial statements. This included selecting statistical samples of unpaid assessments, revenue, refunds, payroll and nonpayroll expenses, property and equipment, and undelivered order transactions. These statistical samples were selected primarily to determine the validity of balances and activities reported in IRS's financial statements. We projected any errors in dollar amounts to the population of transactions from which they were selected. In testing some of these samples, certain attributes were identified that indicated deficiencies in the design or operation of internal control. These attributes, where applicable, were statistically projected to the appropriate populations. * We examined evidence supporting IRS's compliance with learning and education policies. This included selecting non-statistical samples to determine if employees completed all mandatory briefings within the required time frames. * We assessed the accounting principles used and significant estimates made by management. * We evaluated the overall presentation of the financial statements. * We obtained an understanding of IRS and its operations, including its internal control over financial reporting. * We considered IRS's process for evaluating and reporting on internal control and financial systems under 31 U.S.C. 3512 (c), (d), commonly referred to as the Federal Managers' Financial Integrity Act of 1982, and Office of Management and Budget Circular No. A-123, Management's Responsibility for Internal Control. * We assessed the risk of (1) material misstatement in the financial statements and (2) material weakness in internal control over financial reporting. * We tested relevant internal control over financial reporting. * We evaluated the design and operating effectiveness of internal control over financial reporting based on the assessed risk. * We tested compliance with selected provisions of the following laws and regulations: Internal Revenue Code; Antideficiency Act, as amended; Purpose Statute; Prompt Payment Act; Pay and Allowance System for Civilian Employees; Federal Employees' Retirement System Act of 1986, as amended; Social Security Act of 1935, as amended; Federal Employees Health Benefits Act of 1959, as amended; Continuing Appropriations Resolution, 2009, as amended; Financial Services and General Government Appropriations Act, 2009; and American Recovery and Reinvestment Act of 2009. * We tested whether IRS's financial management systems substantially complied with the three FFMIA requirements. * We performed such other procedures as we considered necessary in the circumstances. [End of section] Enclosure II: Comments from the Internal Revenue Service: Department Of The Treasury: Internal Revenue Service: Commissioner: Washington, D.C. 20224: June 21, 2010: Mr. Steven J. Sebastian: Director: Financial Management and Assurance: U.S. Government Accountability Office: 441 G Street, NW: Washington, DC 20548: Dear Mr. Sebastian: I am writing in response to the Government Accountability Office (GAO) draft report titled, Management Report: Improvements Are Needed in IRS's Internal Controls and Compliance with Laws and Regulations (GA0- 10-565R). As GAO noted in the report titled, Financial Audit: IRS's Fiscal Years 2009 and 2008 Financial Statements, we continue to make significant progress in addressing remaining financial management challenges and have substantially mitigated weaknesses in internal controls. During FY 2009, IRS developed traceability of revenue and refund transactions from the general ledger to supporting detailed transaction information. IRS also continued to develop its cost accounting capabilities by implementing full-cost information on numerous IRS programs and activities and measuring the cost-benefit on enforcement programs. These improvements allowed GAO to conclude that these matters no longer constitute internal control deficiencies. The enclosed response addresses each of your recommendations. We are committed to implementing appropriate improvements to ensure that the IRS maintains sound financial management practices. If you have any questions or would like to discuss our response in further detail, please contact me or Alison Doone, Chief Financial Officer, at (202) 622-6400. Sincerely. Signed by: Douglas H. Shulman: Enclosure: [End of letter] IRS Responses to GAO Recommendations in "Management Report: Improvements Are Needed in IRS's Internal Controls and Compliance with Laws and Regulations" GAO-10-565R: Recommendation #1: We recommend that you direct the appropriate IRS officials to review the results of IRS's unpaid assessments compensating statistical estimation process to identify and document instances where systemic limitations in the Custodial Detailed Data Base (CDDB) resulted in misclassifications of account balances that, in turn, resulted in inaccuracies in the amounts of reported unpaid assessments. Comments: IRS agrees with this recommendation. Each year IRS identifies misclassifications of account balances during the review of the sample cases selected for the unpaid assessment statistical estimation and corrects the errors. In the cases of misclassification of account balances caused by a systemic limitation in CDDB, IRS identified programming changes to improve the business rules used by CDDB to accurately classify unpaid tax assessments. IRS briefed GAO on the pending programming changes February 23, 2010. Recommendation #2: We recommend that you direct the appropriate IRS officials to research and implement programming changes to allow CDDB to more accurately classify such accounts among the three categories of unpaid tax assessments. Comments: IRS agrees with this recommendation. IRS continues to identify programming changes to improve the accuracy of the classification of the three categories of unpaid tax assessments in CDDB. The IRS implemented programming changes in January 2010 to classify non-payroll tax forms with reported amounts subject to a Trust Fund Recovery Penalty (TFRP) assessment, and to classify other TFRP assessments that were previously excluded from the TFRP analysis. The IRS is scheduled to implement programming changes in July 2010 that will reduce movement in and out of financial write-off status and identify payroll tax modules where a TFRP assessment was not made. Four additional programming changes are scheduled for implementation in January 2011 to improve the classification of installment agreements, to address one-time refund offsets, to allow CDDB to correctly adjust balances in the subsidiary ledger in cases where TFRP payments were not cross-referenced correctly, and to add an allocation methodology in CDDB to classify modules with split financial classifications. IRS briefed GAO on all of these changes on February 23, 2010. Recommendation #3: We recommend that you direct the appropriate IRS officials to research and identify control weaknesses resulting in inaccuracies or errors in taxpayer accounts that affect the financial reporting of unpaid tax assessments. Comments: IRS agrees with this recommendation. Each year IRS identifies misclassifications of account balances during the review of the sample cases selected for the unpaid assessment statistical estimation and corrects the errors. In addition, IRS reviews Internal Revenue Manual (IRM) procedures to ensure proper internal controls are in place, makes revisions when necessary, and ensures the internal control processes are followed. Recommendation #4: Once IRS identifies the control weaknesses that result in inaccuracies or errors that affect the financial reporting of unpaid tax assessments, we recommend that you direct the appropriate IRS officials to implement control procedures to routinely prevent, or to detect and correct, such errors. Comments: IRS agrees with this recommendation. IRS will continue to identify and validate corrective actions were completed. We will continue to monitor appropriate procedures, controls and program modifications. Recommendation #5: To ensure that Trust Fund Recovery Penalty (TFRP) payments are always and accurately credited to all related parties when received, we recommend that you direct the appropriate IRS officials to revise the Internal Revenue Manual (IRM) to provide specific requirements for supervisors to review the accuracy of credit transactions related to TFRP payments processed through the Automated Trust Fund Recovery (ATFR) system. This guidance should provide specific areas to review and list the ATFR system reports that can facilitate supervisory reviews. Comments: IRS agrees with this recommendation. IRS updated IRM 5.19.14 in May 2010 to include supervisory reviews of the accuracy and timeliness of credit transactions related to TFRP payments processed through ATFR and identified the areas and system reports for review. Recommendation #6: To ensure that TFRP payments are always and accurately credited to all related parties when received, we recommend that you direct the appropriate IRS officials to formalize and implement the quarterly reviews of TFRP payment transactions to monitor compliance with IRM requirements. Recommendation #7: To ensure that TFRP payments are always and accurately credited to all related parties when received, we recommend that you direct the appropriate IRS officials to develop procedures to analyze the results of the quarterly reviews so that specific factors causing the errors are identified. Recommendation #8: To ensure that TFRP payments are always and accurately credited to all related parties when received, we recommend that you direct appropriate IRS officials to develop procedures to address the factors causing errors in the processing of TFRP payment transactions identified through the analyses of the quarterly review results. Comments: IRS agrees with these recommendations. In May 2009, the IRS created the "Quality Assurance Internal Compliance Review" (QAICR) to expand testing beyond existing reviews to further gauge the accuracy and effectiveness of ATFR and to identify TFRP program deficiencies. The IRS quarterly review closely mirrors the GAO review, incorporating TFRP campus case reviews, analysis of findings, and implementation of corrective actions needed to address identified deficiencies. A pilot quarterly review was performed in January 2010, and the results were given to GAO. Quarterly quality reviews began in April 2010. Recommendation #9: We recommend that you direct the appropriate IRS officials to revise the existing methodology for extracting the pre- posted revenue component of the comparison to ensure that non-tax revenues and tax revenue transactions already posted to the master files are properly excluded. Comments: IRS agrees with this recommendation. IRS revised the pre- posted extraction methodology in May 2010 to define transactions that should be excluded from the pre-posted revenue file and added other indicators to better identify pre-posted revenue when the original indicator is changed. IRS sampled the interim pre-posted output file using the new methodology and verified that all non-custodial revenue was excluded. Recommendation #10: We recommend that you direct the appropriate IRS officials to update the desk procedures governing the general ledger to master files comparison to ensure that it reflects the current process and controls. Comments: IRS agrees with this recommendation. IRS will complete the update of the desk procedures for the general ledger to master file comparison to ensure that it reflects the current process and controls by December 31, 2010. Recommendation #11: We recommend that you direct the appropriate IRS officials to revise the cost allocation desk guide to better document the cost allocation process. This should include ensuring that all key processing steps are included and identifying the key sources of input data and the controls necessary to help ensure their reliability. Comments: IRS agrees with this recommendation. IRS revised the cost allocation desk guide in January 2010. The revised desk guide includes key processing steps, key sources of input data, and the controls necessary to help ensure their reliability. Recommendation #12: We recommend that you direct the appropriate IRS officials to revise the IRM and cost allocation desk guide to require appropriate segregation of duties within the cost allocation process. Recommendation #13: We recommend that you direct the appropriate IRS officials to revise the IRM and cost allocation desk guide to require timely, documented supervisory reviews at key process points to help prevent and detect cost allocation processing errors. Comments: IRS agrees with these recommendations. The IRS Chief Financial Officer will update IRM 1.32.3, Managerial Cost Accounting, and the cost allocation desk guide to require appropriate segregation of duties and documented supervisory reviews in the cost allocation process by June 30, 2010. Recommendation #14: We recommend that you direct the appropriate IRS officials to establish controls over the cycle run spreadsheet to help minimize the risk of error or omission. At a minimum, this should include assigning a unique, sortable identifier to each row in the spreadsheet and implementing controls to promptly and accurately record the status of processing steps in a manner that ensures each cycle run is performed and is performed in the proper sequence. Comments: IRS agrees with this recommendation. IRS established procedures and controls over the master version of the cycle-run spreadsheet to minimize the risk of error or omission in May 2010. Each step in the process now contains a unique cycle identifier for the cycle-run order. In addition, IRS reviews and validates that each cycle is performed in the proper sequence. Recommendation #15: We recommend that you direct the appropriate IRS officials to revise the IRM to require Central Insolvency Operation (CIO) to timely provide service center campuses an acknowledgment of receipt for each Form 3210, Document Transmittal, related to a duplicate refund transcript sent to them by a service center campus for review. Comments: IRS agrees with this recommendation. IRS will update IRM 5.9.16 covering the CIO by December 31, 2010, to require that Form 3210, acknowledgment for duplicate refund transcripts, be returned to the issuer within 5 days of receipt. Recommendation #16: We recommend that you direct the appropriate IRS officials to revise the IRM to require service center campuses to verify that an acknowledgment of receipt has been received from CIO for 100 percent of the Form 3210 transmittals related to duplicate refund transcripts they have forwarded to CIO for review. Comments: IRS agrees with this recommendation. IRS will revise IRM 3,17.79 to include procedures for verification of Form 3210 acknowledgments received from the CIO for duplicate refund transcripts at service center campuses by January 31, 2011. Recommendation #17: We recommend that you direct the appropriate IRS officials to revise the IRM to require service center campuses to resolve any instances in which an acknowledgment of receipt for a Form 3210 transmittal related to duplicate refund transcripts is not received. Comments: IRS agrees with this recommendation. Wage and Investment will revise IRM 3.17 to include procedures for follow-up/resolution of non-receipt of Form 3210 acknowledgment of duplicate refund transcripts from CIO function by January 31, 2011. Recommendation #18: We recommend that you direct the appropriate IRS officials to require service center campuses to acknowledge unprocessable items with receipts received from lockbox banks. Recommendation #19: We recommend that you direct the appropriate IRS officials to establish procedures to track service center campus acknowledgments of unprocessable items with receipts. Recommendation #20: We recommend that you direct the appropriate IRS officials to establish procedures to monitor the process used by service center campuses and lockbox banks to acknowledge and track transmittals of unprocessable items with receipts. These procedures should include monitoring discrepancies and instituting appropriate corrective actions as needed. Comments: IRS agrees with recommendations #18, #19, and #20. IRS is developing standardized procedures for the Lockbox Document Transmittals (LDT) in the lockbox network and the service center campuses. IRS revised the LDT form and drafted instructions to include an acknowledgment from the service center campus to the lockbox site. Once the form and instructions have been finalized, the Lockbox Field Coordinators will conduct training with the banks and service center campuses. The Lockbox Bank Performance Measure 'Mailout Review' Data Collection Instrument also will be updated to include tracking and monitoring adherence to the procedures and implementation of corrective actions, as needed. IRS expects to implement these changes by December 31, 2010. Recommendation #21: We recommend that you direct the appropriate IRS officials to review the audit management checklist for clarity and revise the assessment questions as appropriate. Comments: IRS agrees with this recommendation. IRS will review the questions on the audit management checklist and modify them for clarity by December 30, 2010. Recommendation #22: We recommend that you direct the appropriate IRS officials to issue written guidance to accompany the audit management checklist that explains the relevance of the questions and the methods that should be used to assess and test the related controls. Comments: IRS agrees with this recommendation. IRS incorporated instructions for completing the audit management checklist in the December 18, 2009 revision of the checklist. Recommendation #23: We recommend that you direct the appropriate IRS officials to provide training to physical security analysts responsible for completing the audit management checklist to help ensure that checklist questions are answered appropriately and accurately. Comments: IRS agrees with this recommendation. IRS will provide training to physical security analysts on completing the audit management checklist by December 31, 2010. Recommendation #24: We recommend that you direct the appropriate IRS officials to establish and document the minimum frequency for how often the audit management checklist should be completed at each service center campus and field office. Comments: IRS agrees with this recommendation. IRS documented the frequency for completing the audit management checklist at the service center campuses and field offices in Physical Security and Emergency Preparedness (PSEP) Standard Operating Procedure 09-0011 Audit Activity Management Program, dated August 25, 2009. Recommendation #25: We recommend that you direct the appropriate IRS officials to establish policies requiring documented managerial reviews of completed audit management checklists. These reviews should document (1) the time and date of the review, (2) the name of the manager performing the review, (3) the supporting documentation reviewed, (4) any problems identified with the responses on the checklists, and (5) corrective actions to be taken. Comments: IRS agrees with this recommendation. PSEP Standard Operating Procedure (SOP) 09-0011 Audit Activity Management Program, dated August 25, 2009, contains the requirement for documented management reviews of the audit management checklist. IRS will modify the SOP to include the time and date of the review, the name of the manager performing the review, the supporting documentation reviewed, and any problems identified with corrective actions to be taken by July 30, 2010. Recommendation #26: We recommend that you direct the appropriate IRS officials to review the Taxpayer Assistance Centers Security and Remittance Review Database (TSRRD) for clarity and revise review questions as appropriate. Comments: IRS agrees with this recommendation. IRS will review the TSRRD and, where appropriate, clarify and revise the review questions. The TSRRD will be revised to add an IRM point of reference and instructions on how to complete database questions properly by January 31, 2011. Recommendation #27: We recommend that you direct the appropriate IRS officials to provide training to Taxpayer Assistance Centers (TAC) group managers to assist with their understanding of the TSRRD review questions and related objectives. This training should be provided on an ongoing basis to account for changes in TSRRD questions and for newly hired or appointed TAC group managers. Comments: IRS agrees with this recommendation. IRS will include training on the TSRRD in the Filing Season Readiness Workshop DVD delivered to all group managers annually. IRS will conduct the training by March 31, 2011. Recommendation #28: We recommend that you direct the appropriate IRS officials to establish policies that require territory managers or a manager at least one level above the group manager to periodically review the information entered into the TSRRD for accuracy and completeness prior to the results being forwarded to Field Assistance Office headquarters management. This review should be signed and documented, and include (1) the time and date of the review, (2) the name of the manager performing the review, (3) the task performed during the review, (4) any problems or questions identified, and (5) planned corrective actions. Comments: IRS agrees with this recommendation. IRS will update policy to include instructions for the Field Assistance territory manager, or a manager one level above, to review the frontline manager's completed TSRRD responses by March 31, 2011. Managers will review the forms and enter the review results into the TSRRD, and forward it to the territory manager for review and approval along with the planned corrective actions for any problems identified. The review document will include the reviewer's name, date and time of review, issues identified, and corrective actions taken. Recommendation #29: We recommend that you direct the appropriate IRS officials to analyze the various contractor access arrangements and establish a policy that requires security awareness training for all IRS contractors who are provided unescorted physical access to its facilities or taxpayer receipts and information. Comments: IRS agrees with this recommendation. IRS will develop a policy that requires security awareness training for all IRS contractors who are provided unescorted physical access to its facilities or taxpayer receipts and information by June 30, 2011. Recommendation #30: We recommend that you direct the appropriate IRS officials to designate management responsibility and establish a process for monitoring compliance with and enforcing the IRM requirement for all Unit Security Representatives (USRs) to complete (1) the required initial USR training prior to assuming their responsibilities, and (2) annual refresher training each year thereafter. Comments: IRS agrees with this recommendation. All USRs and Alternate USRs were required to take the initial training class by May 31, 2010, and before newly appointed USRs are provided security codes. Annual refresher training is required thereafter. To ensure compliance, IRS plans to implement by December 31, 2010, a reporting capability to identify USRs who fail to comply with initial and annual refresher training requirements. This reporting process will track USR compliance in the Enterprise Learning Management System (ELMS) Learning History and provide notification to affected USRs, their respective managers, and the USR point of contact for remediation. Recommendation #31: We recommend that you direct the appropriate IRS officials to update USR training manuals to ensure they reflect current security policies and procedures. Comments: IRS agrees with this recommendation. On December 15, 2009, IRS launched two new online training courses for all Integrated Data Retrieval System (IDRS) USRs to incorporate current security policies and procedures for USR Initial Training and IDRS USR Annual Refresher Training. These courses provide the initial and annual refresher training required for all IDRS USRs before performing such duties. Recommendation #32: We recommend that you direct the appropriate IRS officials to establish a process to periodically review and update training materials as appropriate. Comments: IRS agrees with this recommendation. IRS implemented an annual review and update of the IDRS USR training material. IRS completed a training content update in December 2009 and expects to complete the next update by December 31, 2010. Recommendation #33: We recommend that you direct the appropriate IRS officials to establish procedures requiring Human Capital Office, Leadership, Education and Delivery Services (NCO LEADS) or their designee to periodically monitor each business unit's progress in complying with mandatory briefing requirements. Comments: IRS agrees with this recommendation. IRS will distribute reports to the business units providing each business unit's progress in complying with the mandatory briefings requirement. Reports will be produced weekly during the mandatory briefing period from July through September and monthly for the remainder of the year. IRS also will begin distribution of a quarterly summary report to the heads of offices by January 31, 2011. Recommendation #34: We recommend that you direct the appropriate IRS officials to establish procedures requiring contracting officers (COs)/contracting officer's technical representatives (COTRs) to obtain and retain written documentation from end users confirming receipt and acceptability of purchased goods and/or services prior to entering acknowledgment of receipt and acceptance in the Web Request Tracking System (WebRTS). Comments: IRS agrees with this recommendation. IRS updated the Receipt and Acceptance Handbook in March 2010 to include the requirement to obtain and retain documentation to support receipt and acceptance before entering the acknowledgment in WebRTS and provided the updated handbook to GAO on March 31, 2010. In addition, Procurement's Policy and Procedures Memorandum No. 46.5, Monitoring Receipt, Acceptance and Quality Assurance through Contract Administration Plans, dated January 1, 2010, instructs all Procurement personnel and COTRs to maintain documentation of receipt of supplies or services. IRS has reinforced this requirement through presentations at the 2010 Procurement Partnership Conference in March 2010, and the 2010 CFO Customer Conference in May 2010. Recommendation #35: We recommend that you direct the appropriate IRS officials to reiterate IRS's policy for staff to indicate in WebRTS during final receipt and acceptance that the payment is a final payment to close out a contract or purchase order to help ensure any remaining obligated funds are timely deobligated. Comments: IRS agrees with this recommendation. IRS issued a WebRTS broadcast e-mail to all WebRTS users on June 2, 2010, to reinforce the use of the receipt and acceptance final flag to ensure timely closure of obligations. IRS will reissue this broadcast quarterly. Recommendation #36: We recommend that you direct the appropriate IRS officials to re-evaluate and, as necessary, revise the aging criteria for the Aging Unliquidated Obligation reviews so that unliquidated obligations are reviewed sooner in order to timely detect and deobligate excess obligations. Comments: IRS agrees with this recommendation. IRS revised the aging criteria for the FY 2010 Aging Unliquidated Obligation reviews from 300 days to 240 days to review unliquidated obligations sooner. Recommendation #37: We recommend that you direct the appropriate IRS officials to provide technicians and supervisors who are responsible for recording and reviewing obligation transactions with training on the proper usage of manually linked obligation transactions to reinforce IRS's existing policy requiring that transactions be recorded accurately to the upward and downward adjustments to prior year obligation accounts. Comments; IRS agrees with this recommendation. IRS revised the manual linking of obligations process, updated the related procedures, and provided additional training to technicians and supervisors in October 2009. IRS provided GAO with the revised procedures and conducted a walk-through of the process for GAO on March 11, 2010. Recommendation #38: We recommend that you direct the appropriate IRS officials to develop controls to improve the linked obligation transaction review process to timely detect and correct erroneous links between unrelated upward and downward adjustments to prior year obligation transactions. Comments: IRS agrees with this recommendation. IRS revised internal processes and implemented procedures to add a second level review of all linked obligations at the time of the actual linking on March 16, 2010. Recommendation #39: We recommend that you direct the appropriate IRS officials to establish a formal funds control process to set aside amounts for tax law enforcement and related support activities, as required by annual appropriations acts. Recommendation #40: We recommend that you direct the appropriate IRS officials to establish a policy to periodically monitor throughout the year the amount of different appropriations accounts attributed to the set-aside to assess IRS's progress toward complying with the requirement. Recommendation #41: We recommend that you direct the appropriate IRS officials to take action based on the results of its periodic assessments, to allocate the required amount of appropriations to tax law enforcement and related support activities to comply with the set- aside requirement. Comments: IRS disagrees with recommendations #39, #40, and #41. In FY 2009, the IRS fully funded its tax law enforcement activities and met the intent of the allocation adjustment. The IRS obligated $5.11 billion of the $5.12 billion (99.7 percent) enforcement appropriation and fully supported the enforcement activities from the operations support account. The IRS obligated $3.75 billion of the $3.76 billion (99.7 percent) of the operations support appropriation expiring funds. The characterization of the 2009 appropriations act in the report is incorrect. The requirement that the IRS spend $7A87 billion on tax law enforcement and related support activities applies to the enforcement appropriation and the operations support appropriation. The intent of the requirement is for the IRS to fully fund enforcement activities and related support activities without diverting funds to non-enforcement activities, and the IRS met that requirement. The IRS cannot unilaterally "set aside" funds from its Taxpayer Services, Business Systems Modernization, and Health Insurance Tax Credit Administration appropriations to fund enforcement activities. The IRS must obtain Office of Management and Budget (OMB) and Congressional approval to move funds among its five appropriation accounts. Further, the IRS cannot "set aside" funds in the Operations Support account exclusively for enforcement activities. The Operations Support account funds both the enforcement and the taxpayer service programs. Operations Support obligations fund common services, including rent, utilities, and information technology infrastructure. The IRS cannot split Operations Support obligations between enforcement and other activities in its accounting system. During the development of the IRS FY 2009 budget request, the pro-rata share of operations support funding attributable to enforcement activities was calculated using an allocation methodology that allocates operations support funds between taxpayer and enforcement activities based on many factors, including Full-Time Equivalent utilization. Congress added $143 million in FY 2009 funding to the taxpayer service account. As a result of the increase in FY 2009 taxpayer service funding that was not anticipated when the FY 2009 budget was developed, the proportion of Operations Support obligations allocated to taxpayer service increased in the post FY 2009 year-end allocation of total Operations Support obligations between Taxpayer Service and Enforcement. In accordance with the FY 2009 enacted budget, the IRS hired 3,000 new enforcement personnel, fully funded enforcement activities, and spent the funding in the Taxpayer Services, Enforcement, and Operation Support accounts consistent with the intent of the law. Because of the unexpected increase in FY 2009 taxpayer service funding, the post year- end allocation methodology run increased the portion of Operations Support dollars allocated to Taxpayer Service. The IRS also disagrees with the characterization of the supplemental analysis provided to GAO in April. The primary change in the April analysis was the assumption that all Enforcement account funds, the pro-rated Operations Support enforcement obligations, and Operations Support balances as of October 1, 2009, were available for the Enforcement Program. This assumption is based on the administrative provision in the appropriations language that "resources shall be available." The initial, more conservative analysis, under which the IRS operated in FY 2009, only included obligations in the Enforcement Program total and excluded unobligated Operations Support balances. Thus, the IRS disagrees that the failure to comply with the appropriations act requirement is attributable to a lack of internal controls to monitor and ensure compliance with its appropriations act requirements. Upon receipt of the additional taxpayer service funds in the FY 2009 enacted budget, the IRS identified the issue and informed both OMB and the House and Senate appropriations committees that the IRS would not meet the funding level contained in the appropriations language. The solution to this issue is a change in the appropriations language to allow the IRS to allocate Operations Support costs between Taxpayer Service and Enforcement Operations in accordance with both the intent of the Congressional allocation adjustment and the IRS cost allocation methodology. The FY 2010 President's Budget Request proposed the required change to appropriations language, and the FY 2010 House Budget Resolution contained the proposed language that "provides that such sums as may be necessary shall be available from the Operations Support account in the Internal Revenue Service to fully support these Enforcement activities." The enacted FY 2010 budget, however, did not include the House Budget Resolution language, and the IRS plans to propose the required language in its FY 2012 budget request. [End of section] GAO Contact and Staff Acknowledgments: GAO Contact: Steve Sebastian, (202) 512-3406 or Sebastians@gao.gov: Acknowledgments: The following individuals made major contributions to this report: Doreen Eng, Assistant Director; LaDonna Towler, Auditor-in-Charge; Russell Brown; Nina Crocker; Oliver Culley; F. Abe Dymond; Lauren S. Fassler; Chuck Fox; Mickie Gray; Ryan Guthrie; Mary Ann Hardy; David Hayes; Ted Hu; Luke Karboski; Sharon Kittrell; Tuan Lam; Rich Larsen; Delores Lee; Jenny Li; Joshua Marcus; Stephanie Miller; Marc Oestreicher; John Sawyer; Christopher Spain; Chevalier Strong; and Tina Wu. [End of section] Footnotes: [1] GAO, Financial Audit: IRS's Fiscal Years 2009 and 2008 Financial Statements, [hyperlink, http://www.gao.gov/products/GAO-10-176] (Washington, D.C.: Nov. 10, 2009). [2] GAO, Information Security: IRS Needs to Continue to Address Significant Weaknesses, [hyperlink, http://www.gao.gov/products/GAO-10-355] (Washington, D.C.: Mar. 19, 2010). [3] IRS's master file contains the detailed records of taxpayer accounts. There are several master files, the most significant of which are the individual master file, which contains tax records of individual taxpayers, and the business master file, which contains tax records of corporations and other businesses. [4] The statute enacting IRS's fiscal year 2009 appropriations required IRS to set aside a minimum of $6,997,000,000 for tax law enforcement, and make an additional $490,000,000 available for enhanced tax law enforcement. See Financial Services and General Government Appropriations Act, 2009, Pub. L. No. 111-8, div. D, tit. I, 105, 123 Stat. 630, 636 (Mar. 11, 2009) (IRS's fiscal year 2009 appropriations act). IRS officials informed us that they interpreted the act as requiring them to set aside $7,487,000,000 (i.e., the sum of the two amounts) for fiscal year 2009 tax law enforcement activities and related support activities. [5] GAO, Standards for Internal Control in the Federal Government, [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1] (Washington, D.C.: November 1999), contains the internal control standards to be followed by executive agencies in establishing and maintaining systems of internal control as required by 31 U.S.C. 3512 (c), (d) (commonly referred to as the Federal Managers' Financial Integrity Act of 1982). [6] SCCs process tax returns and payments submitted by taxpayers. [7] Consolidated campuses are SCC locations where the submission processing function has been eliminated. [8] Lockbox banks are financial institutions designated as depositories and financial agents of the U.S. government under contract with the U.S. Treasury's Financial Management Service to perform certain financial services, including processing tax documents, depositing the receipts, and then forwarding the documents and data to IRS SCCs, which update taxpayers' accounts. During fiscal year 2009, there were eight lockbox banks processing taxpayer receipts on behalf of IRS. [9] TACs are field assistance units, located within IRS's Wage and Investment operating division, designed to serve taxpayers who choose to seek help from IRS in person. Services provided include interpreting tax laws and regulations, preparing tax returns, resolving inquiries on taxpayer accounts, receiving payments, forwarding those payments to appropriate SCCs for deposit and further processing, and performing other services designed to minimize the burden on taxpayers in satisfying their tax obligations. These offices are much smaller facilities than SCCs or lockbox banks, with staffing ranging from 1 to about 35 employees. [10] Field offices are comprised of various units located within IRS's Small Business and Self Employed (SB/SE), Large and Mid-Size Business (LMSB), and Tax-Exempt and Government Entities (TE/GE) operating divisions that administer tax services to corporations, partnerships, small businesses, state and Indian tribal governments, major universities, community organizations, municipalities, pension funds, and individuals with certain types of nonsalary income. [11] An unpaid assessment is a legally enforceable claim against a taxpayer and consists of taxes, penalties, and interest that have been assessed to the taxpayer but not yet collected or abated (reduced). [12] Statement of Federal Financial Accounting Standards No. 7, Accounting for Revenue and Other Financing Sources and Concepts for Reconciling Budgetary and Financial Accounting, May 10, 1996. [13] IRS reports federal taxes receivable on its balance sheet, net of an allowance, for amounts considered uncollectible. [14] GAO, Financial Audit: IRS's Fiscal Years 2008 and 2007 Financial Statements, [hyperlink, http://www.gao.gov/products/GAO-09-119] (Washington, D.C.: Nov. 10, 2008). [15] IRS's master files contain detailed records of taxpayer accounts. However, the master files do not contain all the details necessary to properly classify or estimate collectibility for unpaid tax assessment accounts. [16] CDDB uses a series of computer programs that analyze account information in IRS's master files to classify them into the financial reporting categories. [17] CDDB also serves as a subsidiary ledger for tax revenue and refunds, providing transactional traceability for tax revenue and refund activity between the general ledger and the detailed records. [18] An account module is a record in IRS's master files containing tax assessment, payment, and other information related to a specific type of tax for a specific period. A taxpayer may have multiple account modules within IRS's master files under a unique taxpayer identification number (i.e., Social Security number or an employer identification number). Each unique account module is identified by the taxpayer identification number, tax type (e.g., excise tax, individual tax, payroll tax), and specific tax period (e.g., year, quarter). [19] According to federal accounting standards, the self-reporting of an outstanding tax liability establishes the outstanding balance as a tax receivable for financial reporting purposes. [20] When a business willfully fails to collect, account for, or pay the taxes it is legally required to withhold from its employees' wages, such as Social Security or individual income tax withholdings (what is commonly referred to as "trust fund taxes"), IRS assesses underpayment penalties against the business and may impose an additional trust fund recovery penalty (TFRP) against the responsible officers. [21] [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1]. [22] See for example, 26 U.S.C. 6651, 6654-55, 6662, 6672, 7201-03. [23] See 26 U.S.C. 6672 and IRM 4.23.9.13, Trust Fund Recovery Penalty (May 14, 2008). [24] IRM 5.7.7.4, Cross Referencing of Payments Made by Responsible Persons (Apr. 13, 2006). This was the applicable criteria during the first quarter of fiscal year 2009 for TFRP transactions we tested. [25] We are 95 percent confident that the error rate does not exceed 15.1 percent. According to IRS, it initiated actions to strengthen controls in this area. However, IRS believes that the actions taken thus far have not significantly improved the internal controls and that control deficiencies continue to exist over TFRP payment processing during the first half of fiscal year 2010. [26] [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1]. [27] GAO, Internal Revenue Service: Immediate and Long-Term Actions Needed to Improve Financial Management, [hyperlink, http://www.gao.gov/products/GAO/AIMD-99-16] (Washington, D.C.: Oct. 30, 1998). [28] According to IRS, about 15 percent of total TFRP payment transactions are not processed through ATFR at all but are instead completely manually processed. Such payments relate primarily to TFRP assessments that IRS recorded prior to August 2001 using procedures that prevent ATFR from recognizing related accounts in IRS's master files. [29] IRM 5.19.14, Trust Fund Recovery Penalty (Dec. 22, 2009). [30] As we have reported in conjunction with our annual audit of IRS's financial statements for many years, IRS has a long-standing material weakness in its internal control over unpaid assessments. Most recently, we reported that (1) balances for unpaid assessments reported in IRS's financial statements and required supplementary information were not supported by its general ledger system, (2) IRS lacked a subsidiary ledger to provide reliable transaction-level information for unpaid tax assessments, and (3) IRS experienced errors and delays in recording taxpayer information. Consequently, IRS currently cannot produce reliable unpaid assessments information for internal and external reporting due to systemic limitations and errors in underlying taxpayer accounts, including errors in recording TFRP payments. See [hyperlink, http://www.gao.gov/products/GAO-10-176]. [31] We are 95 percent confident that the actual error rate of invalid pre-posted revenue transactions is not more than 45.3 percent. [32] [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1]. [33] OMB Circular No. A-136, Financial Reporting Requirements (rev. June 10, 2009). [34] IRS defines a cost center as the lowest level at which IRS segregates costs. Cost centers are organizational units that capture costs where someone has control or responsibility. Each cost center has a manager, a head count, and an assigned physical location. [35] [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1]. [36] [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1]. [37] [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1]. [38] IRM 21.4.4.6.1, Duplicate Refund Transcripts (Oct. 1, 2008). [39] [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1]. [40] GAO, Management Report: Improvements Needed in IRS's Internal Controls and Accounting Procedures, [hyperlink, http://www.gao.gov/products/GAO-04-553R] (Washington, D.C.: Apr. 26, 2004); Management Report: Improvements Needed in IRS's Internal Controls, [hyperlink, http://www.gao.gov/products/GAO-05-247R] (Washington, D.C.: Apr. 27, 2005); Management Report: Improvements Needed in IRS's Internal Controls, [hyperlink, http://www.gao.gov/products/GAO-07-689R] (Washington, D.C.: May 11, 2007); Management Report: Improvements Needed in IRS's Internal Controls, [hyperlink, http://www.gao.gov/products/GAO-08-368R] (Washington, D.C.: June 4, 2008); and Management Report: Improvements are Needed to Enhance IRS's Internal Controls and Operating Effectiveness, [hyperlink, http://www.gao.gov/products/GAO-09-513R] (Washington, D.C.: June 24, 2009). [41] [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1]. [42] IRS requires the use of a transmittal form, such as a Form 795 or Form 3210, which list the contents of the package when shipping tax receipts from one IRS location to another. [43] TAC group managers report to territory managers, who in turn report to area directors. [44] [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1]. [45] [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1]. [46] IDRS is an online data retrieval system that manages data retrieved from IRS's master files, which contain detailed information on taxpayers' filings of tax returns and tax-return-related documents. IDRS allows IRS employees to (1) research taxpayer accounts; (2) enter transactions, such as collections, adjustments, and abatements; and (3) automatically generate notices, collection documents, and other information. [47] [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1]. [48] IRM 10.8.34.2.1.11, Unit Security Representative (Sept. 1, 2007). [49] IRM 10.8.34.2.1.7, IDRS Security Officer (Sept. 1, 2007). [50] IRM 10.8.34.2.1.1, Division Commissioners, Chiefs, and Taxpayer Advocate (Sept. 1, 2007). [51] Fiscal year 2008 results were included because it was the most recent year for which IRS could provide complete data at the time of our review. [52] Mandatory briefings for fiscal year 2008 included: (1) Information Protection (Privacy/Disclosure); (2) Safety, Health, and Environmental Awareness; (3) Prevention of Sexual Harassment; and (4) Ethics. Mandatory briefings for fiscal year 2009 included (1) Information Systems Security; (2) Notification and Federal Employee Anti-Discrimination (No FEAR) Act; (3) Computer Security and Unauthorized Access; and, (4) Information Protection. Staff in specific positions may have additional briefing requirements specific to their position. [53] The Wage & Investment Division, which is IRS's largest operating division, scheduled the fiscal year 2009 required briefings for January through May 2010. Because this division's responsibilities include processing tax returns, it relies on a large number of seasonal staff that are only at IRS during these months. [54] [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1]. [55] According to IRS officials, two business units--the Wage & Investment Division and the Human Capital Office, Leadership, Education and Delivery Services organization--provide the mandatory briefings to their staff in a classroom setting. [56] Other transactions, such as micro purchases up to $3,000, are processed by business units rather than the Office of Procurement. [57] A CO must assign a COTR for any contract of $100,000 or more. For contracts under $100,000, a CO has the option of assigning a COTR. If a COTR is not assigned to a contract, then the CO assumes the duties otherwise performed by the COTR. [58] For these five transactions, a COTR was assigned the responsibility of confirming receipt with the end user. Of the 116 transactions we tested, 61 were transactions that were processed through the procurement department. However, because our sample was designed to test all nonpayroll expense transactions, including transactions such as travel that do not go through the procurement department, we are unable to project the exceptions that only applied to procurement transactions to the entire population. [59] [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1]. [60] For example, appropriated funds that are earmarked for tax law enforcement may only be used for expenses related to that purpose. [61] The first instance was identified during our testing of a statistical sample of 58 undelivered order balances as of August 31, 2009. Based on our testing, we estimate that the value of undelivered orders that could have the same control error could be as high as $69.5 million (i.e., the net upper error limit at an 86 percent confidence level). The second instance was identified during our testing of a statistical sample of 43 expense transactions under $50,000 other than payroll expenses as of May 31, 2009. Based on our testing, we estimate that the value of nonpayroll expense transactions less than $50,000 that could have the same control error could be as high as $46.5 million (i.e., the net upper error limit at a 95 percent confidence level). Because this second sample population consisted of expenses rather than obligations, we cannot estimate the value of potential excess obligated funds associated with these expenses. [62] Agencies generally must obligate funds within their period of availability or forfeit the ability to incur new obligations with the funds. In some circumstances, appropriated funds may be awarded for specific purposes with no time limit on when the funds may be used. [63] After the appropriation's period of availability has ended, agencies may use the funds for 5 years to adjust prior-year obligations made from the same appropriation if needed. After that, the funds are forfeited. See 31 U.S.C. 1552-53. [64] In the other instance we identified, the period of availability expired September 30, 2008; however, the funds could still be deobligated and used for an upward adjustment of a prior obligation under that appropriation if needed. [65] IRM 1.33.4.2.4.2.4, AUC and AUO Reviews (Jan. 15, 2008). [66] IRM 1.33.4.4.4, Unliquidated Commitments/Obligations (Aug. 28, 2006). [67] [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1]. [68] Upward and downward adjustments of prior-year obligations are adjustments to obligations funded with prior-year appropriations. [69] Expired funds are netted by obligation identification number and fund. Unexpired funds are netted by obligation identification number, fund, and commitment item. [70] Based on our testing, we estimate that the value of downward adjustments that could have the same control error could be as high as $10.4 million (i.e., the net upper error limit at an 86 percent confidence level). [71] IRM 1.33.4.4.3, Commitments/Obligations (Aug. 28, 2006). [72] [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1]. [73] IRS's fiscal year 2009 appropriations act required IRS to set aside a minimum of $6,997,000,000 for tax enforcement, and make an additional $490,000,000 available for enhanced tax law enforcement. See Financial Services and General Government Appropriations Act, 2009, Pub. L. No. 111-8, div. D, tit. I, 105, 123 Stat. 630, 636 (Mar. 11, 2009). For purposes of this report, we refer to these requirements as a "set-aside." IRS attorneys and IRS budget officials informed us that they interpreted the act as requiring them to set aside $7,487,000,000 (i.e., the sum of the two amounts) for fiscal year 2009 tax law enforcement and related support activities. [74] In fiscal year 2009, IRS was funded through a continuing resolution from October 1, 2008, through March 11, 2009. See Continuing Appropriations Resolution, 2009, Pub. L. No. 110-329, div. A, 112 Stat. 3574 (Sept. 30, 2008), as amended by Pub. L. No. 111-6, 123 Stat. 522 (Mar. 6, 2009). A continuing resolution allows federal agencies to continue operating when their regular appropriations acts have not been enacted before the beginning of the new fiscal year. However, they only provide funding for the period of the continuing resolution and thereby create uncertainty about both the timing and level of funding that ultimately will be available for the entire fiscal year. [75] See, for example, section 131 of the continuing resolution, which appropriated an additional amount for IRS's "Taxpayer Services" to meet the requirements of the Economic Stimulus Act of 2008 (P.L. 110- 185), at a rate for operations of $67,900,000. See Continuing Appropriations Resolution, 2009, Pub. L. No. 110-329, div. A, 112 Stat. 3574, 3579 (Sept. 30, 2008), as amended by Pub. L. No. 111-6, 123 Stat. 522 (Mar. 6, 2009). [76] As discussed earlier in this report, IRS uses a complex process to allocate operations support costs--such as rent and facility costs, technology support, and payroll operation costs--for its major programs. One of the key factors that affects the amount of operations support costs allocated to each program is the number of staff assigned to each. [77] The continuing resolution (P.L. 110-329) appropriated additional funds for IRS's taxpayer services at a rate for operations of $67.9 million. [78] See Financial Services and General Government Appropriations Act, 2009, Pub. L. No. 111-8, div. D, tit. I, 101, 123 Stat. 630, 636 (Mar. 11, 2009). [79] See Financial Services and General Government Appropriations Act, 2010, Pub. L. No. 111-117, div. C, tit. I, 105, 123 Stat. 3159, 3165 (Dec. 16, 2009). [80] We disagree with IRS that it must invoke its transfer authority to transfer amounts between its annual appropriations accounts to effectuate the set-aside. However, IRS may need to initiate reprogramming actions (i.e., the shifting of funds within its individual accounts from one program activity to another), which may be subject to congressional notification requirements. [81] As described in the cost allocation processing section of this report, IRS allocates monthly a portion of operation support costs-- which are costs such as rent and technology support that benefit multiple programs--to each of its major programs. These operations support costs are considered part of the cost of running those programs. [82] See Financial Services and General Government Appropriations Act, 2009, Pub. L. No. 111-8, div. D, tit. I, 105, 123 Stat. 630, 636 (Mar. 11, 2009). [83] IRS contends that it must invoke its authority to transfer funds between its appropriations accounts to use those accounts' funds to satisfy the set-aside requirement. As noted in our report, we disagree with this view given that the appropriations act allows IRS to use any funds made available by the act to satisfy the requirement. Regardless, IRS must identify the sources of funds to be used to satisfy the set-aside requirement and take affirmative actions to ensure such funds are used only for tax law enforcement and related support activities. [84] Continuing Appropriations Resolution, 2009, Pub. L. No. 110-329, div. A, 112 Stat. 3574 (Sept. 30, 2008), as amended by Pub. L. No. 111- 6, 123 Stat. 522 (Mar. 6, 2009). The funding increase was appropriated at a rate for operations of $67.9 million. [End of section] GAO's Mission: The Government Accountability Office, the audit, evaluation and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO's commitment to good government is reflected in its core values of accountability, integrity, and reliability. Obtaining Copies of GAO Reports and Testimony: The fastest and easiest way to obtain copies of GAO documents at no cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each weekday, GAO posts newly released reports, testimony, and correspondence on its Web site. To have GAO e-mail you a list of newly posted products every afternoon, go to [hyperlink, http://www.gao.gov] and select "E-mail Updates." Order by Phone: The price of each GAO publication reflects GAO‘s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO‘s Web site, [hyperlink, http://www.gao.gov/ordering.htm]. Place orders by calling (202) 512-6000, toll free (866) 801-7077, or TDD (202) 512-2537. Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information. To Report Fraud, Waste, and Abuse in Federal Programs: Contact: Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]: E-mail: fraudnet@gao.gov: Automated answering system: (800) 424-5454 or (202) 512-7470: Congressional Relations: Ralph Dawn, Managing Director, dawnr@gao.gov: (202) 512-4400: U.S. Government Accountability Office: 441 G Street NW, Room 7125: Washington, D.C. 20548: Public Affairs: Chuck Young, Managing Director, youngc1@gao.gov: (202) 512-4800: U.S. Government Accountability Office: 441 G Street NW, Room 7149: Washington, D.C. 20548:

The Justia Government Accountability Office site republishes public reports retrieved from the U.S. GAO These reports should not be considered official, and do not necessarily reflect the views of Justia.