Since its first audit of the Internal Revenue Service in 1992, the Government Accountability Office has stressed that the IRS has serious internal control weaknesses, and the GAO’s latest audit of the service was no exception. The IRS’s internal controls are deficient, hindering how its managers make decisions, according to the GAO.
While the IRS has made “great strides” in addressing its deficiencies—and has gotten an unqualified opinion from the GAO for the past seven years—it still has a lot of room for improvement. The GAO blames much of the controls shortfall on the IRS’s inability to modernize and integrate its financial management systems.
In fact, the GAO says, the tax collector’s use of obsolete technology hurts its ability to do its job. “It is unable to obtain comprehensive, timely, accurate, and useful information for day-to-day decision making,” says the GAO’s report on the IRS’s financial statements for fiscal years 2005 and 2006. “Solving IRS’s financial management problems depends largely on the ultimate success of IRS’s ongoing system modernization efforts.”
It’s not as if the IRS hasn’t been trying to improve. The agency has boosted the reliability of its property and equipment records so much that the GAO doesn’t consider that an area of concern. Further, the agency implemented the first phase of its cost accounting module, the Integrated Financial System (IFS), in fiscal year 2005—a big step in mitigating several material weaknesses in its internal controls, the GAO says.
But because of budget constraints and technology issues, the IRS doesn’t plan to expand the system, and has not integrated IFS with its tax processing system. Further rollouts of IFS would have helped with procurement and workload management, according to GAO. Moreover, the IRS has not explained how it will resolve its systems limitations, according to the watchdog agency.
In response to the GAO’s audit, IRS deputy commissioner John Dalrymple wrote a letter, included in the GAO report, saying that his agency has been able to provide the GAO with a timely, accountable financial report for the past two fiscal years, and was able to meet the new requirements outlined in the Office of Management and Budget’s Circular A-123.
Mirroring the requirements of Section 404 of the Sarbanes-Oxley Act, the rules require government agencies’ management to assess the adequacy of internal control over financial reporting, provide a report on material weaknesses, and write up a separate assurance statement on their internal control over financial reporting. To address security issues, Dalrymple said, the agency will expand its use of encryption and improve its information security policies and procedures.
The GAO reported, however, that the IRS’s material weaknesses are evident from control deficiencies over financial reporting, management of unpaid assessments, collection of revenues, and distribution of tax refunds. The accountability office is also concerned with the IRS’s information security controls, saying there is an increased risk of unauthorized people accessing, changing, or abusing proprietary IRS programs and data. And the service is still grappling over addressing its control weaknesses over hard-copy taxpayer receipts and data, according to the audit.
The GAO holds the IRS up to the same standard as the CFO Act agencies, whose systems are required to comply with the Federal Financial Management Improvement Act of 1996. Some of the IRS systems “do not substantially comply,” the GAO says. IRS managers won’t be able to produce reliable financial statements until the agency overcomes the issues related to its outdated technology and weak internal controls, wrote U.S. Comptroller General David Walker in a letter to Treasury secretary Henry Paulson. “IRS continues to lack accurate, useful, and timely financial information and sound controls with which to make fully informed decisions and to ensure ongoing accountability, which is a primary object of the CFO Act,” he wrote.
At the same time, Walker acknowledges that the IRS is a large and complex organization: In fiscal years 2006 and 2005, the agency collected $2.5 trillion and $2.3 trillion, respectively, in tax payments, and paid out about $277 billion and $267 billion in taxpayer refunds.
For his part, the Dalrymple contended that the tax service’s controls are on the upswing. “While challenges remain, the IRS has established its ability to consistently produce accurate and reliable financial statements,” he wrote. “We continue to increase the focus on information security and internal controls while improving financial reporting.”