Management Report: Improvements Are Needed to Enhance the Internal Revenue Service's Internal Controls
GAO-14-433R
Published: Jul 02, 2014. Publicly Released: Jul 02, 2014.
Skip to Highlights
Highlights
What GAO Found
During GAO’s audit of the Internal Revenue Service’s (IRS) fiscal year 2013 financial statements, it identified the following eight new internal control deficiencies, including the first item listed below that was included in GAO’s report on the results of its fiscal year 2013 financial statement audit as a contributing factor to IRS’s continuing significant deficiency in internal control over financial reporting systems as of September 30, 2013:
- Monitoring of internal control at external service organizations. IRS did not obtain sufficient, appropriate evidence to conclude whether internal control at service organizations that were responsible for operating information systems affecting IRS’s financial reporting was effective as of September 30, 2013.
- Processing of time cards. IRS’s policies and procedures for time card approvals and follow-up of time card exceptions were not always effectively followed to reasonably assure that IRS employees’ time cards were proper and that staff did not receive excess pay.
- Receipt and acceptance of goods and services. IRS did not adequately monitor receipt and acceptance transactions that staff entered into its procurement system or provide adequate staff training to reasonably assure the accurate and timely recording of goods and services received.
- Asset acquisition and disposal process. IRS’s controls were not effectively designed and implemented to reasonably assure that (1) assets acquired were timely and accurately recorded in its asset management system, (2) adequate documentation and approval were obtained prior to asset disposal, and (3) assets disposed of did not contain confidential taxpayer or sensitive information.
- Recording of installment agreement user fees. IRS did not have a formal process in place to estimate the financial statement impact of unrecorded installment agreement user fee revenue at year-end or criteria with which to measure the significance of this amount to objectively determine and document whether a year-end adjustment was necessary and, if so, to record an adjustment to reasonably assure that user fees received were properly reflected in its financial statements.
- Collection of installment agreement user fees. IRS’s controls were not effectively designed to prevent or identify and resolve in a timely manner duplicate installment agreement user fees charged to and collected from taxpayers.
- Refunds disbursed to deceased taxpayers. IRS did not have sufficient controls in place to reasonably assure that refunds disbursed on behalf of deceased taxpayers were valid prior to disbursement.
- Deceased taxpayer representatives. IRS’s controls were not operating effectively to reasonably assure that refunds were not disbursed to deceased taxpayers who did not have a personal representative or surviving spouse identified on their accounts to receive the refunds.
Further, IRS had completed corrective action on 26 of the 60 recommendations from GAO’s prior financial audits and other financial management-related work that remained open at the beginning of the fiscal year 2013 financial audit. As a result, IRS currently has 51 recommendations that need to be addressed, consisting of the previous 34 open recommendations and the 17 new recommendations GAO is making in this report.
Why GAO Did This Study
The purpose of this report is to present internal control deficiencies identified during GAO’s audit of IRS’s fiscal year 2013 financial statements for which it does not already have any recommendations outstanding. Although most of these deficiencies were not discussed in GAO’s report on the results of its fiscal year 2013 IRS financial statement audit because they were not considered to be material weaknesses or significant deficiencies, they nonetheless warrant IRS management’s attention. This report provides 17 recommendations to address the internal control issues GAO identified. This report also presents the status, as of September 30, 2013, of IRS corrective actions taken to address 60 previous recommendations made by GAO that remained open at the end of its fiscal year 2012 IRS financial statement audit.
Recommendations
This report provides 2 new recommendations pertaining to the new control deficiency contributing to IRS’s significant deficiency in internal control over financial reporting systems and 15 new recommendations related to the other identified deficiencies. These recommendations are intended to improve IRS’s internal controls over its financial management and accountability of resources as well as bring IRS into conformance with its own policies, Standards for Internal Control in the Federal Government, or both. IRS agreed with all 17 of GAO’s recommendations and described the actions it had taken, had under way, or planned to take to address the control deficiencies described in this report. At the end of the discussion of each issue in this report, GAO summarizes and evaluates IRS’s related comments.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Internal Revenue Service | The Commissioner of Internal Revenue should direct the appropriate IRS officials to issue a reminder to employees responsible for approving time cards that they need to fully understand IRS policy regarding the number of regular work hours employees can record, particularly during pay periods with mandatory furlough hours, and their responsibility for enforcing the policy. |
In fiscal year 2014, IRS issued alerts to appropriate managers or designees of their responsibility to fully understand and adhere to IRS policy when approving timecards. Additionally, IRS issued alerts of IRS policy to all employees regarding work hours. IRS's actions sufficiently address our recommendation.
|
| Internal Revenue Service | The Commissioner of Internal Revenue should direct the appropriate IRS officials to revise the desk procedures for the review of time cards with over 80 hours to include detailed guidance on what time charges are allowable for cases in which an employee has both furlough hours and paid hours in a pay period. |
In April 2014, IRS issued a revised "Posted Duty Over 80 Hours Report" desk guide. It includes specific instructions for determining what time charges are allowed when the employee records both furlough hours and paid hours in the same pay period. IRS's actions sufficiently address our recommendation.
|
| Internal Revenue Service | The Commissioner of Internal Revenue should direct the appropriate IRS officials to establish and implement written procedures for the Office of Procurement to monitor the receipt and acceptance functions of all staff who perform receipt and acceptance. Such monitoring should include reviewing the accuracy and timeliness of receipt and acceptance dates and amounts. |
In June 2015, IRS issued Policy and Procedures Memorandum No. 46.5(A), Receipt and/or Acceptance Monitoring Plan, which establishes a process by which receipt and/or acceptance will be monitored. IRS implemented procedures that require the Policy and Procedures Branch to review the results of the quarterly Beckley Finance Center (BFC) receipt and acceptance audits to determine if further monitoring or action is necessary. The quarterly (1) BFC receipt and acceptance audits include a review of the accuracy and timeliness of receipt and acceptance dates, and (2) the Policy and Procedures Branch to review the quarterly audit results to determine if further monitoring or action is necessary. IRS's actions sufficiently address our recommendation.
|
| Internal Revenue Service | The Commissioner of Internal Revenue should direct the appropriate IRS officials to issue a memorandum to all business units reminding them of the existing policies and procedures that are intended to reasonably assure that (1) asset records are timely and accurately recorded, (2) approval is obtained prior to the disposal of assets and only approved by those properly authorized to do so, and (3) hard drives of disposal assets are wiped clean of sensitive information prior to the disposition. |
During August 2014, IRS's IT organization issued Directive AM 061 "Asset Management Policy and Procedures for KISAM/CIMIS Lifecycle Record Management, Sanitization, and Disposal" and a related memorandum. The Directive and related memorandum reinforced existing policies and procedures intended to reasonably assure that (1) asset records are timely and accurately recorded, (2) approval is obtained prior to the disposal of assets and only approved by those properly authorized to do so, and (3) hard drives of disposal assets are wiped clean of sensitive information prior to the disposition.
|
| Internal Revenue Service | The Commissioner of Internal Revenue should direct the appropriate IRS officials to establish and implement procedures to periodically review master file data extracts of installment agreement user fee transactions to identify and investigate potential duplicate installment agreement user fees charged to taxpayers and make timely corrections. |
In December 2014, IRS established procedures to annually identify, research, and correct potential duplicate installment agreement user fees charged to taxpayers. We verified during our fiscal year 2015 audit that IRS effectively implemented these procedures. IRS's actions sufficiently address our recommendation.
|
| Internal Revenue Service | The Commissioner of Internal Revenue should direct the appropriate IRS officials to update the training manuals and related training provided to Submission Processing examiners to ensure that the examiners are provided proper guidance for correctly processing refund claims associated with deceased taxpayers. |
In fiscal year 2016, IRS updated its training manuals and related training provided to Submission Processing examiners to include guidance for correctly processing refund claims associated with deceased taxpayers. IRS's actions sufficiently address our recommendation.
|
| Internal Revenue Service | The Commissioner of Internal Revenue should direct the appropriate IRS officials to establish and implement policies and procedures requiring a review process to reasonably assure that the accounts related to deceased taxpayers are only reopened for valid refunds. |
In January 2016, IRS automated the process of locking deceased taxpayer accounts during its year-end processing. In January 2017, IRS implemented a process to prevent systemic tax refunds from being issued when a date of death is present on a deceased taxpayer's account. With this process in place, if a deceased taxpayer's account is reopened to process a tax return, IRS performs additional procedures to determine whether the tax refund is valid. IRS's actions addressed the intent of our recommendation.
|
| Internal Revenue Service | The Commissioner of Internal Revenue should direct the appropriate IRS officials to establish and implement policies and procedures that require monitoring to reasonably assure that accounts related to deceased taxpayers that have been reopened are timely closed after processing the refund. |
In January 2016, IRS automated the process of locking deceased taxpayer accounts during its year-end processing. In January 2017, IRS implemented a process to prevent systemic tax refunds from being issued when a date of death is present on a deceased taxpayer's account. With this process in place, systemic tax refunds do not get processed on reopened deceased taxpayer accounts that were not timely closed. Instead, IRS performs additional procedures to determine whether the tax refunds are valid. IRS's actions addressed the intent of our recommendation.
|
| Internal Revenue Service | The Commissioner of Internal Revenue should direct the appropriate IRS officials to issue a memorandum to IRS staff reminding them of the requirements and the procedures to follow to ensure that a representative is listed on a deceased taxpayer's account before issuing a refund on the account. |
In March 2015, IRS issued a memorandum reminding IRS staff of the requirements and the procedures to follow to ensure that a representative is listed on a deceased taxpayer's account before issuing a refund on the account. IRS's actions sufficiently address our recommendation.
|
| Internal Revenue Service | To improve the effectiveness of its monitoring of internal control over external service organizations' operating information systems material to IRS's financial reporting, the Commissioner of Internal Revenue should direct the appropriate IRS officials to revise the service organization monitoring procedures to require, when using an auditor's report prepared in accordance with the Statements on Standards for Attestation Engagements (SSAE) No. 16 to monitor internal control over financial reporting, clearly documenting that IRS appropriately (1) considered any user controls identified as not being included within the scope of the SSAE No. 16 report, (2) identified those user controls that are relevant and material to IRS, and (3) verified that either those controls or comparable, relevant user controls were in place and operating effectively at IRS. |
During fiscal year 2015, IRS developed and implemented a supplement standard operating procedure guidance document that required, when using an auditor's report prepared in accordance with SSAE No. 16 to monitor internal control over financial reporting, clearly documenting that IRS appropriately (1) considered any user controls identified as not being included within the scope of the SSAE No. 16 report; (2) identified those user controls that are relevant and material to IRS; and (3) verified that either those controls or comparable, relevant user controls, were in place and operating effectively at IRS. IRS's actions sufficiently address our recommendation.
|
| Internal Revenue Service | The Commissioner of Internal Revenue should direct the appropriate IRS officials to establish a written requirement for timekeeping staff to complete a review of all time cards with over 80 hours before IRS transmits time cards to the National Finance Center for processing or immediately after so that errors can be timely identified and corrected. |
In September 2014, IRS established Standard Operating Procedures that require timekeeping staff to review all time and attendance records with over 80 hours before transmitting them to the National Finance Center for processing or immediately after, so that errors can be timely identified and corrected before employees are compensated. IRS's actions sufficiently address our recommendation.
|
| Internal Revenue Service | To improve the effectiveness of its monitoring of internal control over external service organizations' operating information systems material to IRS's financial reporting, the Commissioner of Internal Revenue should direct the appropriate IRS officials to, for each service organization that is significant to IRS's financial reporting and related internal control and for which a current SSAE No. 16 report has not been prepared, establish a memorandum of understanding or agreement with the organization that requires (1) both parties to perform procedures that are consistent with the most current requirements of the Office of Management and Budget Circular No. A-123 and (2) the service organization to provide IRS access to the organization's personnel, documents, facilities, or combination of these necessary to allow IRS to timely and effectively conduct its own monitoring procedures or review and validate the reliability of monitoring documentation prepared by organization management, as appropriate. |
During fiscal year 2015, IRS established memorandums of understanding/agreement, interconnectivity security agreement, or both with significant service organizations that required (1) both parties to perform procedures that are consistent with the most current requirements of the Office of Management and Budget Circular No. A-123 and (2) the service organization to provide IRS access to the organization's personnel, documents, facilities, or combination of these necessary to allow IRS to timely and effectively conduct its own monitoring procedures or review and validate the reliability of monitoring documentation prepared by organization management, as appropriate. IRS's actions sufficiently address our recommendation.
|
| Internal Revenue Service | The Commissioner of Internal Revenue should direct the appropriate IRS officials to enhance existing mandatory training for all employees who are granted the Integrated Procurement System (IPS) access to perform receipt and acceptance to include specific instructions for determining the appropriate dates and amounts to enter for receipt and acceptance in IPS. |
In April 2015, IRS enhanced its mandatory training for all employees who are granted IPS access to record receipt and acceptance to include specific instructions for determining appropriate dates and amounts to enter for receipt and acceptance into IPS. IRS also enhanced its Receipt and Acceptance Training user tool, which is available to employees on the IRS intranet. IRS's actions sufficiently address our recommendation.
|
| Internal Revenue Service | The Commissioner of Internal Revenue should direct the appropriate IRS officials to update the Enterprise Operations unit (EOps) policies and procedures as necessary, which may include providing requisite permissions to certain EOps staff to enable them to directly update the Knowledge, Incident/Problem, Service Asset Management, to reasonably assure that assets received are recorded in the asset management systems within 10 workdays as required by the IRM. |
In August 2014, IRS's Information Technology organization updated its policies and procedures to allow EOps inventory staff to directly update the Knowledge, Incident/Problem, Service Asset Management system to record assets received in the asset management systems within 10 workdays as required by the IRM. IRS's actions sufficiently address our recommendation.
|
| Internal Revenue Service | The Commissioner of Internal Revenue should direct the appropriate IRS officials to update the Internal Revenue Manual (IRM) to require monitoring the functions of all staff as they relate to receipt and acceptance functions, including applicable end users. |
In July 2015, IRS updated IRM 1.35.3, Financial Accounting, Receipt and Acceptance Guidelines to require monitoring the functions of all staff as they relate to receipt and acceptance functions, including applicable end users. The IRM defines responsibilities for the Director of the Beckley Finance Center and the Director of the Office of Procurement, as well as all Business Units. IRS's actions sufficiently address our recommendation.
|
| Internal Revenue Service | The Commissioner of Internal Revenue should direct the appropriate IRS officials to establish and document objective criteria for determining materiality for the purpose of determining whether to record an adjustment for installment agreement user fees collected but not yet recorded as exchange revenue or cash in IRS's fund balance with Treasury in IRS's accounting records by fiscal year-end. |
In June 2014, IRS issued desk procedures that established materiality threshold to be used by IRS staff as a basis for determining whether to record an adjustment for installment agreement user fees collected but not yet recorded as exchange revenue or cash in the fund balance with Treasury in IRS's accounting records at fiscal year-end. IRS's actions sufficiently address our recommendation.
|
| Internal Revenue Service | The Commissioner of Internal Revenue should direct the appropriate IRS officials to establish and implement written procedures for (1) estimating the potential financial statement impact of IA user fees collected but not yet recorded as exchange revenue or cash in IRS's accounting records by fiscal year-end, (2) comparing the potential impact against established materiality criteria, and (3) making an adjustment in IRS's accounting records for the amount of the potential impact if it meets or exceeds the established criteria for recording such an adjustment. |
In June 2014, IRS issued desk procedures that provide guidance to staff for (1) estimating the potential financial statement impact of IA user fees collected but not yet recorded as exchange revenue or cash in IRS's accounting records by fiscal year-end, (2) comparing the potential impact against established materiality criteria, and (3) making an adjustment in IRS's accounting records for the amount of the potential impact if it meets or exceeds the established criteria for recording such an adjustment. IRS's actions sufficiently address our recommendation.
|
Full Report
GAO Contacts
Topics
AssetsAttendance recordsFinancial managementFinancial statement auditsFinancial statementsInternal controlsMonitoringTax information confidentialityTaxpayersUser feesCorrective actionMaterial weaknesses