Information Technology: IRS Needs to Complete Modernization Plans and Fully Address Cloud Computing Requirements
Fast Facts
The IRS relies extensively on its IT systems to collect taxes and distribute refunds. However, much of its IT infrastructure is outdated, which can increase cybersecurity risks, staffing issues, and costs.
As of August 2022, the IRS had 21 modernization initiatives, including 9 to replace its outdated IT systems. However, 6 of those 9 initiatives did not specify how they would dispose of outdated systems—a key element in IT modernization. Officials stated they would address this element at the appropriate time.
We made 9 recommendations to the IRS, including that it establish time frames to complete its IT modernization plans.
Highlights
What GAO Found
The Internal Revenue Service's (IRS) legacy IT environment includes applications, software, and hardware, which are outdated but still critical to day-to-day operations. Specifically, GAO's analysis showed that about 33 percent of the applications, 23 percent of the software instances in use, and 8 percent of hardware assets were considered legacy. This includes applications ranging from 25 to 64 years in age, as well as software up to 15 versions behind the current version. As GAO has previously noted, and IRS has acknowledged, these legacy assets will continue to contribute to security risks, unmet mission needs, staffing issues, and increased costs.
Modernization best practices call for documenting plans that include three key elements: milestones, work to be performed, and disposition of legacy systems. As of August 2022, IRS had documented plans for the 21 modernization initiatives that were underway, including nine associated with legacy systems. All 21 plans addressed two key elements. However, the plans for six of the nine initiatives did not address the disposition of legacy systems (see table). Officials stated they would address this key element at the appropriate time in the initiatives' lifecycle; however, they did not identify time frames for doing so.
GAO Assessment of the Internal Revenue Service's (IRS) Modernization Plans as of August 2022
|
Modernization plan element |
Yes |
No |
Not applicable |
|---|---|---|---|
|
Includes milestones |
21 |
0 |
0 |
|
Describes work to be performed |
21 |
0 |
0 |
|
Includes disposition of legacy systems |
3 |
6 |
12a |
Source: GAO analysis of IRS documents. | GAO-23-104719
aThese initiatives were not associated with legacy systems.
IRS recently suspended operations of six initiatives, including two which are essential to replacing the 60-year old Individual Master File (IMF). The IMF is the authoritative data source for individual tax account data. GAO has reported that IRS has been working to replace IMF for well over a decade. According to officials, the suspensions were due to IRS's determination to shift resources to higher priorities; staff members working on these suspended initiatives were reassigned to other projects. As a result, the schedule for these initiatives is now undetermined. Accordingly, the 2030 target completion date for replacing the IMF that IRS announced last year is now unknown. This will lead to mounting challenges in continuing to rely on a critical system with software written in an archaic language requiring specialized skills.
IRS's cloud computing efforts fully addressed 11, partially addressed one, and did not address two requirements identified in the Office of Management and Budget's June 2019 cloud computing strategy. Key shortfalls include IRS not conducting regular evaluations of customer experiences and user needs. Until IRS fully addresses all cloud computing requirements, it will have less assurance that it is adopting cloud solutions that efficiently and effectively help it meet its mission needs and protect sensitive taxpayer information.
Why GAO Did This Study
IRS relies extensively on IT to annually collect trillions of dollars in taxes, distribute hundreds of billions of dollars in refunds, and carry out its mission of providing service to America's taxpayers in meeting their tax obligations. This reliance on IT includes a significant amount of outdated legacy systems that pose risks. At the same time, IRS has increasingly used internet-based computing services (i.e., cloud services) to address its IT modernization needs.
GAO was asked to review IRS's legacy environment and cloud computing implementation. This report, among other things, 1) describes IRS's legacy IT environment; 2) assesses IRS's modernization plans; and 3) evaluates its cloud computing efforts.
To do so, GAO analyzed legacy applications, software, and hardware data; assessed plans for 21 modernization initiatives against practices identified in prior GAO work; and compared IRS's cloud computing documentation to relevant federal requirements. GAO also interviewed knowledgeable IRS officials.
Recommendations
GAO is making nine recommendations to IRS, including that it establish time frames to complete selected modernization plans, and fully address OMB's cloud computing requirements. IRS agreed with all nine recommendations.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Internal Revenue Service | The Commissioner of the IRS should ensure that IRS establishes time frames for addressing the disposition of legacy systems for the Enterprise Case Management modernization initiative and follow through to document a complete modernization plan. (Recommendation 1) |
IRS provided an update in June 2024. We are currently reviewing the documentation and will update the status of the recommendation appropriately.
|
| Internal Revenue Service | The Commissioner of the IRS should ensure that IRS establishes time frames for addressing the disposition of legacy systems for the Enterprise Data Platform modernization initiative and follow through to document a complete modernization plan. (Recommendation 2) |
IRS provided an update in June 2024. We are currently reviewing the documentation and will update the status of the recommendation appropriately.
|
| Internal Revenue Service | The Commissioner of the IRS should ensure that IRS establishes time frames for addressing the disposition of legacy systems for the Information Returns Modernization initiative and follow through to document a complete modernization plan. (Recommendation 3) |
IRS provided an update in June 2024. We are currently reviewing the documentation and will update the status of the recommendation appropriately.
|
| Internal Revenue Service | The Commissioner of the IRS should ensure that IRS establishes time frames for addressing the disposition of legacy systems for the Information Technology Service Management modernization initiative and follow through to document a complete modernization plan. (Recommendation 4) |
IRS provided an update in June 2024. We are currently reviewing the documentation and will update the status of the recommendation appropriately.
|
| Internal Revenue Service | The Commissioner of the IRS should ensure that IRS establishes time frames for addressing the disposition of legacy systems for the Enterprise Anomaly Detection / Enterprise Case Selection modernization initiative and follow through to document a complete modernization plan when it resumes. (Recommendation 5) |
IRS provided an update in June 2024. We are currently reviewing the documentation and will update the status of the recommendation appropriately.
|
| Internal Revenue Service | The Commissioner of the IRS should ensure that IRS establishes time frames for addressing the disposition of legacy systems for the Workforce Infrastructure modernization initiative and follow through to document a complete modernization plan when it resumes. (Recommendation 6) |
IRS provided an update in June 2024. We are currently reviewing the documentation and will update the status of the recommendation appropriately.
|
| Internal Revenue Service | The Commissioner of the IRS should ensure that IRS's cloud computing efforts fully address the key OMB requirement associated with standardizing cloud contract service level agreements that will provide more effective, efficient, and secure cloud procurement outcomes for agencies. (Recommendation 7) |
IRS provided an update in June 2024. We are currently reviewing the documentation and will update the status of the recommendation appropriately.
|
| Internal Revenue Service | The Commissioner of the IRS should ensure that IRS's cloud computing efforts fully address the key OMB requirement associated with developing and implementing policy to contracts impacting high value assets that are managed and operated in the cloud, including requirements that provide continuous visibility of the asset. (Recommendation 8) |
IRS provided an update in June 2024. We are currently reviewing the documentation and will update the status of the recommendation appropriately.
|
| Internal Revenue Service | The Commissioner of the IRS should ensure that IRS's cloud computing efforts fully address the key OMB requirement associated with conducting regular evaluations of customer experiences and user needs to ensure that cloud solutions foster efficiency, accessibility, and privacy. (Recommendation 9) |
IRS provided an update in June 2024. We are currently reviewing the documentation and will update the status of the recommendation appropriately.
|