Thank You
ADMINISTRATIVE OPERATIONS
=========================================================== Appendix 3
ACCOUNTING FOR APPROPRIATED
FUNDS HAS IMPROVED BUT MORE IS
NEEDED
--------------------------------------------------------- Appendix 3:1
IRS successfully implemented its new administrative accounting system
in fiscal year 1993. This new system better positions IRS to correct
some of its administrative accounting problems and provides a good
foundation for building accurate and reliable cost data that can be
used to determine the costs of IRS' operations. However, some of the
potential improvements that could be realized from this new system
have been undermined by IRS' failure to establish and carry out
rudimentary internal controls.
As discussed in our opinion letter, IRS continues to have problems
reconciling its fund balance with Treasury accounts, and it has not
been able to provide support to show that goods and services were
received for purchases made from other government agencies. Further,
IRS' accounting records continue to have significant amounts of
adjusting and correcting accounting entries, several of which we
found to be incorrect. These problems make the accuracy of any
underlying cost information IRS uses to compute performance measures
or to report the costs of its operations to the Congress or others
uncertain. Also, IRS continues to have problems achieving the goals
of the Prompt Payment Act. IRS continues to regularly make late
vendor payments.
IMPLEMENTATION OF GENERAL
LEDGER SYSTEM PROVIDES A
SOLID CORE FOR IRS'
FINANCIAL MANAGEMENT
IMPROVEMENT EFFORTS
------------------------------------------------------- Appendix 3:1.1
Information in IRS' core general ledger system and its related
subsidiary records should be the foundation for any cost accounting
system, cost information used for performance measures, and financial
reporting done by IRS. The most crucial aspect of any financial
management system is a core general ledger system that accurately
describes and records all revenues, receipts, expenses,
disbursements, and accruals of an agency in a timely manner. In our
first-ever financial statement audit of IRS for fiscal year 1992, we
found that IRS did not have an effective core general ledger system
and could not provide reliable detailed information for over 64
percent of its appropriated monies. However, for fiscal years 1993
and 1994, after its new general ledger system was implemented, IRS
could provide such detail.
Under its old general ledger system, IRS could not reliably identify
the detailed expenditures that occurred and thus was unable to
accurately report the costs of its operations. For example, as
stated earlier, for fiscal year 1992, IRS could not identify all
expenditures that were made for over 64 percent of its 1992
appropriated funds. IRS' situation in 1992 would be analogous to
someone entering checks into their checkbook for the year and keeping
a cumulative total of the balance and at the end of the year adding
up the checks and getting a balance that is quite different than the
cumulative balance in the checkbook, and being unable to determine
why the difference exists. The inability to determine why the
difference exists could be due to a variety of reasons that range
from innocent errors that went undetected to someone fraudulently
taking funds and not reporting it. In IRS' case, IRS did not know
why the differences were occurring.
IRS' new general ledger system arrays IRS' expenditures by
appropriation and management activity code--codes used to describe
the nature of the expenditure and which part of IRS' operation the
cost is associated with. The system also identifies all transactions
that were made whether the transactions were done correctly or not.
Thus, when problems are identified, IRS now has the ability to
research what occurred and determine the correct solution.
RUDIMENTARY PROBLEMS
PERSIST--MORE SUPERVISION
AND TRAINING ARE NEEDED
------------------------------------------------------- Appendix 3:1.2
In spite of IRS' successful efforts in implementing its new general
ledger system, the accuracy of information included therein continues
to be uncertain because IRS did not adhere to fundamental internal
controls that ensure the accuracy of data entered into its general
ledger. In some instances, internal controls were properly
prescribed but not followed, while in other instances effective
internal control procedures were not in place. The deficiencies we
found resulted from a lack of competence or resources to perform the
necessary job responsibilities or a willful intent not to comply with
prescribed internal controls. Any of these causes dictates the need
for closer supervision and better training of staff to ensure that
data entered into the general ledger are accurate and complete. In
addition to the issues discussed in our opinion, we found the
following deficiencies:
IRS routinely processed its interagency purchases in a poor manner
because key staff knowingly and consistently did not follow
established procedures. Payments to other government agencies
regularly occurred without being recorded for months and, in
some instances, were still not recorded and were a major cause
of IRS' inability to reconcile its Fund Balance with Treasury
accounts. This happened because IRS accounting staff did not
record these payments in the accounting records until a document
confirming receipt and acceptance was received from IRS
personnel who purchased the item, even though the money had
already been taken from IRS' accounts. While this is a good
policy, it is poorly implemented.
Interagency charges to IRS' Fund Balance with Treasury accounts that
occur where receipt of goods or services received has not been
verified are not researched and resolved in a timely manner. We
found several interagency payments in our sample of accounts payable
where payments charged to IRS' Fund Balance with Treasury accounts
maintained by Treasury were not recorded in IRS' records.
We found correcting and adjusting journal entries affecting expense
accounts that were arbitrarily done and others that were
incorrect. For example, we found that IRS arbitrarily decreased
its reported future funding requirements and appropriations used
by $126 million and wrote off $14 million from its invested
capital account without any supportable basis for doing so.
Also, we found that IRS failed to record an accrual for $340
million in workman's compensation expense in 1993. Thus, IRS'
cost of operations were understated by $340 million in 1993.
In addition to these fundamental internal control problems, IRS
continues to make late payments to vendors for goods and services
purchased. Generally, the Prompt Payment Act was passed to encourage
federal agencies to pay their debts on time and, where they paid
late, to pay interest on the amount owed. While IRS was generally in
compliance with these requirements, IRS internal reports showed that
IRS was late on 39,248 payments, totaling $108 million, out of
234,743 payments, totaling $740 million, that were subject to Prompt
Payment requirements. IRS internal reports showed that IRS paid
$506,529 in interest related to these late payments.
These problems point to the need for IRS to more effectively
supervise and train its staff to perform established procedures, to
develop or clarify procedures where necessary, and to ensure that it
has the proper skill mix of staff to competently perform the work
required. This focus would allow IRS to effectively use its new
administrative accounting system.
SEIZED ASSETS
=========================================================== Appendix 4
MORE COMPLETE AND RELIABLE
INFORMATION IS NEEDED TO
MEASURE THE EFFECTIVENESS OF
THE SEIZED ASSET PROGRAM
--------------------------------------------------------- Appendix 4:1
In order to compel payment of delinquent taxes and encourage
voluntary compliance with the Internal Revenue Code (IRC), IRS is
authorized to seize and sell the assets of delinquent taxpayers and
those who violate internal revenue laws and certain other statutes
involving financial crimes. However, IRS lacked adequate systems to
provide information to evaluate the effectiveness of its seizure
programs and provide an analysis of its seizure activities.
For example, for fiscal year 1994, IRS systems could not provide
reliable information on (1) the expenses incurred from its seizure
activity, (2) revenue realized from the sale of seized assets, or (3)
the potential revenue that could be realized from the sale of seized
assets reported in its ending balance. IRS' systems were unable to
provide such information because IRS has no tracking or inventory
system to monitor the progression of seized assets from seizure to
final disposition. Without this information, IRS management could
not effectively manage program expenses, make cost-benefit decisions
regarding its seizure activity, or evaluate the success of its
seizure programs.
Furthermore, IRS systems could not provide an analysis of its seizure
activity in compliance with the disclosure requirements of the
federal accounting standard on inventory and related property, dated
October 27, 1993.\29 IRS used manual reconciliations between its
general ledger and records maintained at the district level to
support its analysis of seizure activity. IRS also used these
reconciliations to support its balance of $782 million for seized,
acquired, and collateral properties reported in the financial
statements for fiscal year 1994.\30
The extent of errors noted during our preliminary review of the
reconciliations precluded us from auditing the seized asset balance.
Out of a judgmental sample of 143 assets,\31 we found that 57 assets
should not have been included in the ending balance because of double
counting errors, the assets had been disposed of, or IRS did not have
actual or constructive control over the assets because of litigation.
An additional 6 assets were found to be seized as of year-end but not
included in IRS' detailed records. Out of a sample of 100 assets
reported as fiscal year 1994 dispositions, we found that 15 assets
had been disposed of in prior fiscal years.
Further, IRS financial statements do not include $6.5 million in
criminal investigation seizures classified as nonmonetary assets.
This amount includes $676,246 in foreign currency, bonds, and other
monetary instruments that were misclassified as nonmonetary assets.
After we discussed this issue with IRS officials, they agreed to
reclassify the $676,246 and disclose it in the financial statements.
In addition, IRS does not disclose the amount for collateral as a
footnote to accounts receivable in the financial statements. Such
disclosure could indicate the portion of outstanding taxes that are
secured by other assets.
Because of these problems, in testimony before the House Subcommittee
on Oversight, Committee on Ways and Means,\32 we stated that IRS
should seek another agency or contractor to handle the property
management functions that it now carries out in disposing of seized
property. Notwithstanding that we believe that the management
function should be handled outside of IRS, IRS officials stated that
a new system was implemented in fiscal year 1995 that it believes
will track its seized assets related to the collection of delinquent
taxpayer accounts.
--------------------
\29 An analysis of seizure activity should include the value and
number of assets on hand at the start of the year, seized during the
year, disposed of during the year, and on hand at year-end, as well
as known encumbrances against the property.
\30 Acquired property represents assets purchased by IRS for future
sales. Collateral property represents assets pledged as security for
outstanding or potential tax liabilities.
\31 The judgmental sample of 143 assets consisted of 120 assets
listed in the year-end balance and 23 assets listed in the seizure
logbooks maintained at the district offices.
\32 Tax Administration: IRS' Management of Seized Assets,
(GAO/T-GGD-92-65, September 24, 1992).
COMPUTER SECURITY
=========================================================== Appendix 5
SOME IMPROVEMENTS MADE BUT
OVERALL COMPUTER SYSTEMS
SECURITY REMAINS WEAK
--------------------------------------------------------- Appendix 5:1
In our prior year reports,\33 we stated that IRS' computer security
environment was inadequate. Our fiscal year 1994 audit found that
IRS has made some progress in addressing and initiating actions to
resolve prior years' computer security issues; however, some of the
fundamental security weaknesses we previously identified continued to
exist in this fiscal year.
These weaknesses were primarily IRS employees' capacity to make
unauthorized transactions and activities without detection. IRS has
taken some actions to restrict account access, review and monitor
user profiles, provide an automated tool to analyze computer usage,
and install security resources. However, we found that IRS still
lacks sufficient safeguards to prevent or detect unauthorized
browsing of taxpayer information and to prevent staff from changing
certain computer programs to make unauthorized transactions without
detection.
While not specifically designed to do so, our limited review did not
identify any instances where someone outside of IRS could enter its
computing environment and perform unauthorized transactions. We
reviewed general computer security controls at two IRS computing
centers and 3 of its 10 service centers. Some of the more compelling
problems we found were as follows:
controls did not adequately prevent users from unauthorized access
to sensitive programs and data files,
numerous users had been given authorized access to powerful system
privileges which could allow circumvention of existing security
controls,
a system that houses a variety of other applications also housed
taxpayer data, which increased the risk that this data could be
made accessible to large numbers of users,
input and approval duties for processing disbursements on a key
administrative application during fiscal year 1994 were not
always appropriately separated, thus allowing users to input
unauthorized transactions and process them through to completion
without detection, and
security reports prepared to monitor and identify unauthorized
access to the system continue to be cumbersome and virtually
useless to managers responsible for ensuring computer security.
We also found that IRS' current disaster recovery plan at the Service
Centers does not adequately address what should occur for IRS to
fully recover from a disaster at the Service Centers. In addition,
further efforts are required in better defining disaster recovery
procedures at the Martinsburg and Detroit Computing Centers.
We were told that better defining the disaster recovery plan was not
given a high priority because of resource constraints. However, such
detailed plans are critical for IRS to ensure that its primary
operations will not be interrupted for an unnecessary period of time
in the event of a disaster. During our fiscal year 1994 review, we
noted that IRS had established Disaster Recovery Analysts at each of
its 10 service centers to expedite its disaster recovery planning
efforts. Also, IRS awarded a contract for recovery services and
completed recovery testing for some Martinsburg and Detroit Computing
Center applications.
As we reported last year, these long-standing weaknesses are
symptomatic of broader computer security management issues. The
overriding problem we found is that IRS still does not have a
proactive, independent information security group that is
systematically deployed to review the adequacy and consistency of
security over IRS' computer operations. Instead, information
security issues are addressed on a reactive basis. Such a function
could proactively identify problems that need to be corrected and
regularly report to the Commissioner any problems identified that
were not resolved in a timely manner. The lack of such a group and
information security focus has resulted in inconsistencies among
centers and instances of noncompliance with procedures identified in
the Internal Revenue Manual.
The need for such a function is further heightened because of the
time it takes IRS to implement corrective actions once a problem is
identified. For example, the Electronic Audit Research Log (EARL)
initiative was intended to deter unauthorized browsing and other
activities by identifying potential unauthorized accesses based on
certain criteria designed to highlight the activity. However, this
initiative, which was started 3 or 4 years ago, is still not fully
implemented. In addition, an independent information security group
would ensure that TSM implementation efforts have proper security
controls put in place as the systems are developed.
A second fundamental weakness in IRS' computer security management is
that it has not completed formal risk assessments of its systems to
determine system sensitivity and vulnerability as required by OMB
Circular A-130. Information security needs vary by system based on
the nature and sensitivity of the data being processed by each system
and the number of users. To properly identify, prioritize, and then
implement appropriate controls, an overall risk assessment of each
system should be performed to identify critical systems and their
vulnerabilities. IRS must also evaluate the overall security of the
computing environment by taking into account connections among the
various systems. Such assessments have not been effectively
performed.
As a result of these weaknesses, IRS did not have reasonable
assurance that the confidentiality and accuracy of taxpayer data were
protected and that the data were not manipulated for purposes of
personal gain. Such weaknesses also diminish the reliability of IRS'
financial management information. Although IRS has taken or plans to
take steps to resolve some of these weaknesses, such as segregating
duties, improving security reports, and expediting disaster recovery
efforts, more effort to continuously identify weaknesses and
implement corrective actions is needed.
--------------------
\33 Financial Audit: Examination of IRS' Fiscal Year 1992 Financial
Statements (GAO/AIMD-93-2, June 30, 1993); IRS Information Systems:
Weaknesses Increase Risk of Fraud and Impair Reliability of
Management Information (GAO/AIMD-93-34, September 22, 1993); and
Financial Audit: Examination of IRS' Fiscal Year 1993 Financial
Statements (GAO/AIMD-94-120, June 15, 1994).
FINANCIAL STATEMENTS
=========================================================== Appendix 6
(See figure in printed
edition.)
Selected Financial and
Operating Data
(See figure in printed
edition.)
Overview to the Financial
Statements
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
Statements of Financial
Position (Administrative)
(See figure in printed
edition.)
Statements of Operations
(Administrative)
(See figure in printed
edition.)
Statements of Cash Flows for
Appropriated Funds
(Administrative)
(See figure in printed
edition.)
Statements of Budget and Actual
Expenses (Administrative)
(See figure in printed
edition.)
Notes to Financial Statements
(Administrative)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
Statements of Financial
Position (Custodial)
(See figure in printed
edition.)
Statements of Collections
(Custodial)
(See figure in printed
edition.)
Notes to Financial Statements
(Custodial)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
Supplemental Financial
Information (Custodial)
(See figure in printed
edition.)
Supplemental Financial
Information (Custodial)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
Supplemental Management
Information
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
(See figure in printed
edition.)
REPORTS ISSUED AS A RESULT OF
GAO'S AUDIT OF IRS' FISCAL YEARS
1992 AND 1993 FINANCIAL STATEMENTS
AND STATUS OF RECOMMENDATIONS
=========================================================== Appendix I
The results of our efforts to audit IRS' fiscal year 1992 and 1993
Principal Financial Statements were presented in our reports entitled
Financial Audit: Examination of IRS' Fiscal Year 1992 Financial
Statements (GAO/AIMD-93-2, June 30, 1993) and Financial Audit:
Examination of IRS' Fiscal Year 1993 Financial Statements
(GAO/AIMD-94-120, June 15, 1994). The system and internal control
weaknesses identified in the 1992 report and recommendations to
correct them were discussed in more detail in six reports. In fiscal
year 1993, we issued one report that included the system and internal
control weaknesses and recommendations. These are discussed in the
appendix by section.
We determined the status of the following recommendations based on
our audit work at IRS during fiscal year 1994 and on our discussions
with IRS officials. Our assessments of IRS' actions for the most
significant recommendations are discussed in the report. However, we
have not fully assessed the appropriateness or effectiveness of all
of the responses identified in the following table. We plan to
update our assessment of IRS' responses as part of our fiscal year
1995 audit.
Action
in
planni No
ng or specif
Action planni ic
Action in ng action
comple progre comple planne
Report/recommendations te ss te d
-------------------------------------- ------ ------ ------ ------
Financial Audit: IRS Significantly
Overstated Its Accounts Receivable
(GAO/AFMD-93-42, May 6, 1993)
Provide the IRS Chief Financial X
Officer authority to ensure that IRS
accounting system development efforts
meet its financial reporting needs. At
a minimum, the Chief Financial
Officer's approval of related system
designs should be required.
Take steps to ensure the accuracy of X
the balances reported in IRS financial
statements. In the long term, this
will require modifying IRS systems so
that they are capable of (1)
identifying which assessments
currently recorded in the Master File
System represent valid receivables and
(2) designating new assessments that
should be included in the receivables
balance as they are recorded. Until
these capabilities are implemented,
IRS should rely on statistical
sampling to determine what portion of
its assessments represent valid
receivables
Clearly designate the Chief Financial X
Officer as the official responsible
for coordinating the development of
performance measures related to
receivables and for ensuring that IRS
financial reports conform with
applicable accounting standards.
Modify the IRS methodology for X
assessing the collectibility of its
receivables by
--including only valid accounts
receivable in the analysis;
--eliminating, from the gross
receivables balance, assessments
determined to have no chance of being
collected;
--including an analysis of individual
taxpayer accounts to assess their
ability to pay;
--basing group analyses on categories
of assessments with similar collection
risk characteristics; and
--considering current and forecast
economic conditions, as well as
historical collection data, in
analyses of groups of assessments.
Exam Certified Independent Representative for the
Save A Patriot Fellowship
(916) 689-8973
Tuesdays; 10:00pm EST.Mention Jim on the Internet told you about it. Hear you there!
24 hour fax on demand:
(281)890-2360 DOC # 682
E-mail:
[
They told the truth!! ]
[
[ NEW VICTORY EXPRESS!! ] [ HELP US HELP AMERICA! ]
[ Reasonable Action ] [ The Truth Behind the Income Tax! ] [ Products ]
[ Social Security? ] [ Tax Basics 101 ] [ Just the Facts ] [ What is SAP ]
[ UNITED STATES CONSTITUTION ] [ GAO AUDITS THE IRS! ]
[ Do you love America? How about the IRS? ] [ Why I did this site ]