Improvements Can Be Made to the Internal Revenue Service’s Federal Financial Management Improvement Act Remediation Plan Process

June 2001

Reference Number: 2001-10-093

 

This report has cleared the Treasury Inspector General for Tax Administration disclosure review process and information determined to be restricted from public release has been redacted from this document.

June 13, 2001

MEMORANDUM FOR COMMISSIONER ROSSOTTI

FROM: Pamela J. Gardiner /s/ Pamela J. Gardiner

Deputy Inspector General for Audit

SUBJECT: Final Audit Report - Improvements Can Be Made to the Internal Revenue Service’s Federal Financial Management Improvement Act Remediation Plan Process

This report presents the results of our review of the effectiveness of the Internal Revenue Service’s (IRS) remediation plan in resolving identified financial management weaknesses and the progress the IRS has made in implementing the remediation plan. In summary, the IRS has made significant improvements with its remediation plan. However, work still needs to be done in identifying resource commitments for all remedial actions, performing independent verifications of completed remedial actions, and monitoring revised or long-term remedial action intermediate target dates.

Management agreed with our recommendations and has initiated corrective actions to identify resources for all remediation plan actions, independently verify and test completed remedial actions, and verify and monitor the reasonableness of revised remedial action intermediate target dates. Management’s comments have been incorporated into the report where appropriate, and the full text of their comments is included as an appendix.

Copies of this report are also being sent to the IRS managers who are affected by the report recommendations. Please contact me at (202) 622-6510 if you have questions or Maurice S. Moody, Associate Inspector General for Audit (Headquarters Operations and Exempt Organizations Programs), at (202) 622-8500.

Table of Contents

Executive Summary

Objective and Scope

Background

Results

Resource Commitments Need to Be Identified for the Remediation Plan to Be in Compliance with the Federal Financial Management Improvement Act

An Independent Process Needs to Be in Place to Verify and Test the Effectiveness of Implemented Remedial Actions

Effective Monitoring of Remedial Action Intermediate Target Dates Is Needed to Ensure Actions Are Implemented Timely

Conclusion

Appendix I – Detailed Objective, Scope, and Methodology

Appendix II – Major Contributors to This Report

Appendix III – Report Distribution List

Appendix IV – Management’s Response to the Draft Report

Executive Summary

The Federal Financial Management Improvement Act of 1996 (FFMIA) emphasizes certain financial management system requirements that are established by Executive Branch policies. The Act also establishes new requirements for auditors to report on agency compliance with these basic requirements and for agency heads to correct deficiencies within a certain time period.

Each agency is required to implement and maintain financial management systems that comply substantially with federal financial management systems requirements, applicable federal accounting standards, and the United States (U.S.) Government Standard General Ledger at the transaction level. Further, if the head of the agency determines that the agency’s financial management systems do not comply with the above requirements, the head of the agency, in consultation with the Director of the Office of Management and Budget, shall establish a remediation plan. The remediation plan shall include resources, remedies, and intermediate target dates necessary to bring the agency’s financial management systems into substantial compliance.

The overall objective of this review was to evaluate the effectiveness of the Internal Revenue Service’s (IRS) remediation plan in resolving identified financial management weaknesses and the progress the IRS has made in implementing the remediation plan. Tests were also performed as required by the FFMIA to identify any missed remediation plan intermediate target dates. This review was conducted as part of an agency-wide review of all Department of the Treasury bureaus.

Results

The IRS has made significant improvements with its remediation plan. Our follow-up of previously reported Treasury Inspector General for Tax Administration (TIGTA) findings showed that all weaknesses identified by the General Accounting Office (GAO) during its financial statement audits were included in the remediation plan and that intermediate target dates were identified for all remedial actions. Except for issues noted in this report, remedial actions included in the remediation plan directly addressed the identified weaknesses and, if fully implemented, were reasonable to correct the associated weaknesses. Further, we did not identify any missed intermediate target dates during the period of our review that would require specific reporting by the TIGTA as outlined in the FFMIA.

However, the IRS’ remediation plans through September 30, 2000, continued to not fully comply with the requirements of the FFMIA, in that resource commitments were not identified for all remedial actions (a previously reported condition). Further, the IRS was not performing independent verifications of implemented remedial actions, and it was not sufficiently providing explanations in its remediation plans for the necessity of revised remedial action intermediate target dates.

During our audit, the IRS developed and issued interim reporting responsibilities and requirements, which included a management responsibility to ensure that proper documentation to verify remedial action implementation is maintained and a status requirement to ensure that a description of the reason for a delay in implementing an action is provided. If the responsible organizations in fact maintain and provide such documentation, the IRS should be able to more effectively monitor the timely completion of remediation plan actions.

Resource Commitments Need to Be Identified for the Remediation Plan to Be in Compliance with the Federal Financial Management Improvement Act

Our review of the June 30, 2000, custodial component of the remediation plan identified four weaknesses where resource commitments were not identified. In addition, we identified one weakness for which the indicated resource commitment was not clear.

We subsequently reviewed the September 30, 2000, remediation plan. Of the four weaknesses we had previously identified in the June remediation plan as lacking commitments, three had been rectified. The one weakness previously identified as having a vague resource commitment was shown as "pending."

By not determining the extent of resources needed to fully implement remedial actions, the IRS cannot effectively evaluate the commitments needed to correct cited weaknesses. This could delay the completion of the actions due to insufficient resources being available when needed.

An Independent Process Needs to Be in Place to Verify and Test the Effectiveness of Implemented Remedial Actions

The IRS did not establish an independent verification and testing process to ensure that remedial actions reported as completed sufficiently corrected noted weaknesses. In its Fiscal Year (FY) 1999 financial statement audit, the GAO reported that one completed remedial action was ineffective to correct the identified weakness. As a result, the IRS will be updating the desk procedures to address the errors identified by the GAO.

Further, 8 weaknesses involving 22 remedial actions were reported as completed at the time of our review. However, since the IRS did not perform any independent testing of these actions, it will have no assurance of the actions’ effectiveness until an outside organization, such as the GAO, completes testing and reports its findings related to the annual audit of the IRS’ financial statements.

Without a process to verify the effectiveness of completed remedial actions, the IRS is at risk of having financial management systems that continue to not meet financial system requirements.

Effective Monitoring of Remedial Action Intermediate Target Dates Is Needed to Ensure Actions Are Implemented Timely

Our review and comparison of the March 31, June 30, and September 30, 2000, remediation plans to the December 30, 1999, remediation plan identified 10 in-process remedial actions for which intermediate target dates were extended. The revised intermediate target dates ranged from 1 month to 3 years past the original intermediate target dates. Several of the changes were not sufficiently explained in the remediation plans to allow an independent verification as to their reasonableness.

Our review of the remediation plans through September 2000 also identified that, of the 32 remedial actions still in process, 14 actions had intermediate target dates in FYs 2002, 2003, and 2004. This situation further emphasizes the need for a proactive monitoring process to not only monitor intermediate target dates but also to verify that accomplishment dates within remedial actions that have intermediate target dates in subsequent fiscal years are being established and met.

Without an effective process for monitoring remedial action intermediate target dates, delays in implementation may occur that will increase the risk of the IRS having financial management systems that do not meet financial system requirements.

Summary of Recommendations

The Chief Financial Officer, in consultation with responsible IRS organizational officials, should take an active role in identifying resource needs for all remediation plan actions, independently verifying and testing completed remedial actions, and verifying the reasonableness of revised remedial action intermediate target dates, including accomplishment dates for remedial actions that have intermediate target dates in subsequent fiscal years.

Management’s Response: IRS management agreed with our recommendations and has initiated corrective actions to identify resources for all remediation plan actions, independently verify and test completed remedial actions, and verify and monitor the reasonableness of revised remedial action intermediate target dates. Management’s complete response to the draft report is included as Appendix IV.

Objective and Scope

This review was performed as required by the Federal Financial Management Improvement Act of 1996 (FFMIA). The overall objective of this review was to evaluate the effectiveness of the Internal Revenue Service’s (IRS) remediation plan in resolving identified financial management weaknesses and the progress the IRS has made in implementing the remediation plan, including the identification of any missed intermediate target dates.

As part of our review, we judgmentally selected a sample of 24 of the 44 weaknesses included in the March 31, 2000, remediation plan. The selection was based on the relevant impact the weakness had on the IRS’ financial management systems and compliance with the FFMIA. To accomplish our objective, we reviewed the current and prior remediation plans, General Accounting Office (GAO) audit reports, and detailed remedial action work plans. We also interviewed IRS management officials and conducted analyses to evaluate their monitoring process to ensure efficient and timely implementation of remediation plan actions, including the identification of missed intermediate target dates. Further, we followed up on previously reported conditions contained in our Letter Report: Improvements Are Needed in the Internal Revenue Service’s Federal Financial Management Improvement Act Remediation Plan (Reference Number 2000-10-105, dated August 2000).

This review was conducted as part of an agency-wide review of all Department of the Treasury bureaus. The Treasury Inspector General for Tax Administration (TIGTA) reviewed the IRS, and the Treasury Office of Inspector General (OIG) reviewed the remaining bureaus.

Our audit work was performed in the Office of the Chief Financial Officer (CFO) and affected IRS divisions. This audit was performed from June to December 2000 in accordance with Government Auditing Standards.

Details of our audit objective, scope, and methodology are presented in Appendix I. Major contributors to this report are listed in Appendix II.

Background

The FFMIA emphasizes certain financial management system requirements that are established by Executive Branch policies. The Act also establishes new requirements for auditors to report on agency compliance with these basic requirements and for agency heads to correct deficiencies within a certain time period.

Each agency is required to implement and maintain financial management systems that comply substantially with federal financial management systems requirements, applicable federal accounting standards, and the United States (U.S.) Government Standard General Ledger at the transaction level. Further, if the head of the agency determines that the agency’s financial management systems do not comply with the above requirements, the head of the agency, in consultation with the Director of the Office of Management and Budget (OMB), shall establish a remediation plan. The remediation plan shall include resources, remedies, and intermediate target dates necessary to bring the agency’s financial management systems into substantial compliance.

The GAO and the Treasury OIG have identified numerous internal control weaknesses in the IRS’ financial operations during their annual audits of the financial statements. The GAO reported material weaknesses in the IRS’ reporting of unpaid assessments, refunds, property and equipment, and accounting for liabilities and accrued expenses. Based on the above material weaknesses, the IRS’ financial systems did not substantially comply with federal financial management systems requirements, applicable federal accounting standards, and the U.S. Government Standard General Ledger at the transaction level.

As required by the FFMIA, the IRS prepared a remediation plan. The plan was separated into two major components of the IRS’ financial systems -- Custodial and Administrative.

The remedies included in the remediation plan are to be developed by the organizations that would be most responsible for correcting them. Each organization is responsible for identifying applicable remedies, resources, and intermediate target dates, as well as ensuring remedial actions are completed timely. Also, each organization is responsible for reporting the implementation status of assigned remedies to the CFO’s Office of Management and Controls (OMC).

Results

The IRS has made significant improvements with its remediation plan. As part of our follow-up of previously reported TIGTA findings, we concluded that all weaknesses identified by the GAO during its financial statement audits were included in the remediation plan and intermediate target dates were identified for all remedial actions. Further, a memorandum was sent from the Department of the Treasury to the OMB requesting concurrence with the IRS remedial actions having intermediate target dates that exceed the required 3-year time period.

Except for the issues noted in this report, remedial actions included in the remediation plan directly addressed the identified weaknesses and, if fully implemented, would be reasonable to correct the associated weakness.

Also, we did not identify any missed intermediate target dates during the period of our review that would require specific reporting by the TIGTA as outlined in the FFMIA.

However, the IRS’ remediation plans through September 30, 2000, continued to not fully comply with the requirements of the FFMIA, in that resource commitments were not identified for all remedial actions (a previously reported condition). Further, the IRS was not performing independent verifications of implemented remedial actions, and it was not sufficiently providing explanations in its remediation plans for the necessity of revised remedial action intermediate target dates.

Resource Commitments Need to Be Identified for the Remediation Plan to Be in Compliance with the Federal Financial Management Improvement Act

Four weaknesses contained in the custodial component of the June 30, 2000, remediation plan did not identify resource commitments. In addition, there was one weakness for which the indicated resource commitment was not clear.

During the period of our audit, we also reviewed the September 30, 2000, remediation plan. Of the four weaknesses previously identified in the June remediation plan as lacking commitments, three had been rectified. The one weakness previously identified as having a vague resource commitment was shown as "pending."

Section 803(c)(3)(A) of the FFMIA states that an agency’s remediation plan shall include resources necessary to bring the agency’s financial management systems into substantial compliance.

In response to the TIGTA Letter Report, the OMC developed and issued reporting instructions for the remediation plan. The instructions indicated that each remedial action must have resources identified as required by the FFMIA. In addition to stressing the importance of identifying resources, the instructions provided guidance on identifying and recommending resource commitments.

While the CFO’s OMC officials were not sure why some of these remedial actions lacked resource commitments, the following factors were offered as possible causes:

By not determining the extent of resources needed to fully implement remedial actions, the IRS cannot effectively evaluate the commitments needed to correct cited weaknesses and avoid further noncompliance with the requirements of the FFMIA. Further, this condition could delay the completion of the actions due to insufficient resources being available when needed.

Recommendation

  1. The CFO’s office, in consultation with responsible IRS organizational officials, should coordinate the identification of resource needs for all remediation plan actions.
  2. Management’s Response: The IRS has identified resources for all remedies in the remediation plan.

    An Independent Process Needs to Be in Place to Verify and Test the Effectiveness of Implemented Remedial Actions

    The IRS was not verifying or performing tests on an independent basis to ensure that completed remedial actions sufficiently corrected noted weaknesses. Remediation plan (dated June 30, 2000) custodial weakness #14, concerning review procedures over the adjustment and summarization of assessment data used in excise tax certifications, was noted as completed in December 1998. However, the GAO reported, as a result of its Fiscal Year (FY) 1999 financial statement audit, that the implementation of the new policy was ineffective. As a result of the GAO finding, the IRS will be updating the desk procedures to address the errors identified by the GAO.

    Further, 8 weaknesses involving 22 remedial actions were reported as completed at the time of our review. However, since the IRS did not perform any independent testing of these actions, it will have no assurance of the actions’ effectiveness until an outside organization, such as the GAO, completes testing and reports its findings related to the annual audit of the IRS’ financial statements.

    When monitoring the status of remedial actions, the OMC considered only timeliness and notification of a completion date. The verification of the effectiveness of a particular remedy correcting a specific weakness was not deemed to be an OMC responsibility.

    Section 803(c)(3)(A) of the FFMIA states that a remediation plan shall include remedies necessary to bring the agency’s financial management systems into substantial compliance. Sound management practices would dictate that to ensure identified financial management weaknesses are corrected, an independent process needs to be in place to verify and test the effectiveness of implemented remedial actions.

    During this audit, the OMC developed and issued interim reporting responsibilities and requirements which included a management responsibility to ensure that proper documentation to verify implementation of remedial actions is maintained. If the responsible organizations in fact maintain such documentation and the documentation is reviewed by the OMC, the IRS should not have to rely on an outside organization to determine if implemented remedial actions effectively correct reported financial management weaknesses.

    Without a process to verify the effectiveness of completed remedial actions, the IRS is at risk of having financial management systems that continue to not meet financial system requirements.

    Recommendation

  3. The CFO’s office should take an active role in the independent verification and testing of completed remedial actions to ensure that identified weaknesses are effectively corrected.
  4. Management’s Response: The OMC issued guidelines requiring managers to maintain proper documentation verifying the implementation of all actions. This documentation will verify the OMC assessed the effectiveness of the actions and found them adequate. The OMC will report any exceptions to the Financial and Management Controls Executive Steering Committee.

    Effective Monitoring of Remedial Action Intermediate Target Dates Is Needed to Ensure Actions Are Implemented Timely

    All the remedial action intermediate target dates contained in the March 31, June 30, and September 30, 2000, remediation plans were compared to the December 30, 1999, remediation plan in succession. This analysis identified 10 in-process remedial actions for which intermediate target dates were extended. The revised dates ranged from 1 month to 3 years past the original intermediate target dates.

    Several of the changes were not sufficiently explained in the remediation plans to allow an independent verification as to their reasonableness. Previously, the responsible officials were not required to submit a certification or substantiation as to why intermediate target dates were being revised. Further, the OMC, in monitoring the status of remediation plan action items, did not perform independent verifications of progress made in the implementation of a remedial action.

    During this audit, the OMC developed and issued interim reporting responsibilities and requirements which included a status requirement to ensure that a description of the reason for a delay in implementing an action is provided. If the responsible organizations in fact provide such documentation and it is reviewed by the OMC, the IRS should be able to more effectively monitor the timely completion of remediation plan actions.

    In addition, beginning in October 2000, the Department of the Treasury required that remediation plans be tracked on its Inventory Tracking and Closure System (ITCS). The ITCS is a Department-wide, interactive, real-time system that includes key information on audit reports issued by the Treasury OIG, the TIGTA, and the GAO. The system contains a number of automated reports for monitoring and highlighting matters that need to be addressed by Departmental and/or bureau management. The ITCS users can track information on audit reports from the date of issuance through completion of all action items.

    Our review of the remediation plans through September 2000 also identified that, of the 32 remedial actions still in process, 2 had intermediate target dates in FY 2002, 8 had intermediate target dates in FY 2003, and 4 had intermediate target dates in FY 2004. This situation further emphasizes the need for a proactive monitoring process to not only monitor intermediate target dates but also to verify that accomplishment dates within remedial actions that have intermediate target dates in subsequent fiscal years are being established and met.

    Section 803(c)(3)(A) of the FFMIA states that an agency’s remediation plan shall include intermediate target dates necessary to bring the agency’s financial management systems into substantial compliance. Sound management practices would dictate that to ensure identified financial management weaknesses are timely corrected, a process needs to be in place to monitor intermediate target dates and to fully substantiate the need to revise them.

    If the IRS does not enforce the timely completion of remedial actions, delays in implementation may occur that will increase the risk of the IRS having financial management systems that do not meet financial system requirements.

    Recommendations

  5. The CFO’s office should take an active role in the verification of the reasonableness of revised remedial action intermediate target dates to ensure that identified weaknesses are timely corrected.
  6. Management’s Response: The OMC issued reporting responsibilities requiring offices to explain the reason for a delay. The OMC will review and retain this documentation. The OMC will not revise dates until responsible officials provide adequate documentation.

  7. The CFO’s office should ensure that accomplishment dates are established and monitored for remedial actions that have intermediate target dates in subsequent fiscal years.

Management’s Response: The ITCS tracks all actions, including those in future years. The OMC issued reporting instructions to ensure responsible officials appropriately document completed actions according to schedule.

Conclusion

The IRS has made significant improvements with its remediation plan. However, work still needs to be done in the area of identifying resource commitments for all remedial actions to fully comply with the requirements of the FFMIA. Further, the IRS needs to ensure that independent verifications are performed of implemented remedial actions and that sufficient documentation is maintained in support of revised remedial action intermediate target dates.

The IRS has initiated interim reporting responsibilities and requirements which include sections on the maintenance of documentation for implemented remedial actions and descriptions of the reasons for delayed intermediate target dates. This new guidance should assist the IRS in improving its FFMIA remediation plan process. If the compliance and process issues identified in this report are not fully addressed by IRS management, the IRS will continue to be non-compliant with the FFMIA requirements and may further delay the implementation of financial management systems that are in accordance with the FFMIA.

Appendix I

Detailed Objective, Scope, and Methodology

The overall objective was to evaluate the effectiveness of the Internal Revenue Service’s (IRS) remediation plan in resolving identified financial management weaknesses and the progress the IRS has made in implementing the remediation plan, including the identification of any missed intermediate target dates. The following steps were conducted to accomplish this objective:

  1. To determine whether established remedies will resolve the identified weaknesses and bring the financial management systems of the IRS into compliance with the Federal Financial Management and Improvement Act of 1996 (FFMIA), we:
    1. Judgmentally selected a sample of 24 of the 44 weaknesses included in the March 31, 2000, remediation plan. The selection was based on the relevant impact the weakness had on the IRS’ financial management systems and compliance with the FFMIA. The sample included 5 completed, 17 in-progress/not started, and 2 weaknesses that should have been completed during the scope of the audit.
    2. Reviewed prior General Accounting Office (GAO) audit reports and related management comments and gained an understanding of the issues related to the weaknesses.
    3. Reviewed the remediation plan and related detailed action/work plans and gained an understanding of the remedies proposed to correct the weaknesses.
    4. Compared the reported weaknesses to the proposed remedial actions and assessed the reasonableness of the actions to timely resolve the weaknesses.
    5. Identified the individuals responsible for developing/implementing the remedial actions and assessed their capacity to perform the activities related to the remedial actions.
    6. Obtained budgetary data for implementing the remedial action and assessed the sufficiency of the funding.
  2. To determine whether demonstrated progress has been made in implementing remediation plan remedies, we:
    1. Performed audit steps II. B. through II. D using the sample selected in step I. A.
    2. Obtained status reports, work plans, memoranda, and Requests for Information Systems (RIS) and interviewed the IRS analysts concerning work performed and/or completed.
    3. Obtained documentation supporting implemented items and verified reported progress to actual progress.
    4. Examined any changes to implementation actions, time periods, or human resource commitments that indicated a problem with the remediation as a whole.
  3. To determine whether the IRS is adequately monitoring the status of the FFMIA remediation plan for both efficiency and timeliness, we:
    1. Identified through discussions with the Chief Financial Officer’s (CFO) Office of Management and Controls (OMC) the process used to monitor the status and timeliness of weaknesses.
    2. Obtained documentation of independent verification of progress and verified the process identified in step III. A.
    3. Compared initial target dates with current status for all remedial actions and identified weaknesses that appeared to be behind schedule.
    4. For implemented actions, determined whether management tested the action and ensured the changes were successful.
    5. Interviewed the OMC to determine the CFO’s relationship with the Executive Steering Committee (ESC) and identified the ESC’s role in resolving the FFMIA weaknesses.
    6. Obtained the ESC meeting minutes and identified any Committee actions that would have an effect on any remediation plan actions.
    7. Followed up with OMC management and determined whether they were aware of ESC actions.
  4. To determine whether the IRS has taken corrective actions on previously reported Treasury Inspector General for Tax Administration (TIGTA) findings concerning the remediation plan, we:
    1. Discussed with the CFO officials the status of previously reported TIGTA findings.
    2. Verified completion or in-process status of previously reported TIGTA findings.

Appendix II

Major Contributors to This Report

Maurice S. Moody, Associate Inspector General for Audit (Headquarters Operations and Exempt Organizations Programs)

John R. Wright, Director

Thomas Brunetto, Audit Manager

Regina Dougherty, Senior Auditor

Melinda Pope, Senior Auditor

Bobbie Draudt, Auditor

Andrew Harvey, Auditor

Appendix III

Report Distribution List

Deputy Commissioner N:DC

Chief Financial Officer N:CFO

Chief Counsel CC

Director, Financial Analysis N:CFO:F

Director, Office of Program Evaluation and Risk Analysis N:ADC:R:O

Director, Legislative Affairs CL:LA

Office of Management Controls N:CFO:F:M

National Taxpayer Advocate TA

Audit Liaison, Office of the Chief Financial Officer N:CFO

Appendix IV

Management’s Response to the Draft Report

The response was removed due to its size. To see the complete response, please go to the Adobe PDF version of the report on the TIGTA Public Web Page.