TREASURY INSPECTOR GENERAL
FOR TAX ADMINISTRATION
Controls Over the Development of the Practitioner Secure Messaging System Prototype Should Be Improved
Reference No. 2001-20-022
The Internal Revenue Service (IRS) Restructuring and Reform Act of 1998 (RRA 98) requires the IRS to provide electronic tax account information to taxpayers who electronically file their income tax returns. The IRSí Electronic Tax Administration (ETA) Office started the Practitioner Secure Messaging System (PSMS) Prototype Project in December 1998 to develop a system that allows tax practitioners to use the Internet to request actions or information on their clientsí tax accounts.
The overall objectives of this audit were to determine whether the PSMS Prototype was managed using sound project management controls and whether the PSMS Prototype was coordinated with the IRS Business Systems Modernization (BSM) Program, which is developing new IRS computer systems.
The PSMS Prototype is the IRSí first system that uses the Internet to directly interact with the public to exchange taxpayer information. It is a research and development project with the purpose of determining the most productive way to securely receive and respond to tax practitioner requests over the Internet and to provide lessons learned to the IRSí full-scale secure messaging project. Some of the lessons learned to date include identifying: a lack of technical knowledge among tax practitioners about the Internet, conflicts between the tax practitionersí wide variety of computer hardware and software configurations and the PSMS Prototypeís software, and technical problems with Internet processing and security software.
Although these lessons learned will certainly benefit the overall modernization effort, we identified several opportunities to improve the control and oversight of the PSMS Project.
Development of the Prototype Outside the Business Systems Modernization Program Is Inconsistent With Prior Audit Recommendationsand the Internal Revenue Service Organization Blueprint
The PSMS Prototype is currently being developed by the ETA Office in the Wage and Investment Division. This management approach conflicts with the IRSí response to prior audit recommendations and the IRS organization blueprint, which suggest that systems development activities be centrally managed. Specifically:
Because the PSMS Prototype provides new Customer Service functionality and includes the development of a new system that implements new technology, we believe the BSM Program in the CIO organization should control the PSMS Project. The BSM Program is currently responsible for new systems development and is developing a secure messaging system with objectives similar to the PSMS Prototype. Inclusion of the Project in the BSM Program would also provide management control and oversight consistent with that of other systems modernization activities. ETA and BSM Program management did not combine the two projects because Prototype development was already underway and moving the Prototype to BSM management was believed to be inefficient. The ETA Office has other systems development projects underway (for example, the Employer Identification Number Prototype), which may also warrant oversight by the BSM Program.
The Prototype Project Management Controls Can Be Strengthened
Basic project management controls (such as preparing a business case, detailed project work schedules, and interim milestone dates) were not used to help identify the complexity of the PSMS Project and address potential implementation problems. ETA management indicated that they viewed the PSMS Prototype as a short-lived part of a systems development life cycle and, therefore, did not implement some basic project management controls. Completion of the PSMS Prototype was delayed from June 2000 to September 2001, due in part to the lack of effective project management controls. In addition, the authorized costs increased from approximately $368,000 to $2.5 million.
The Prototype Project Spending Controls Can Be Improved
Review of the contractorís status reports and billing records indicated they did not always contain accurate information and sufficient detail for ETA management to verify the accuracy of the bills. ETA management had not effectively followed up on insufficient detail on the contractorís periodic billing vouchers. Therefore, management had not identified inaccurate information in the billing vouchers and could not be sure that the IRS paid for only authorized work.
Summary of Recommendations
The Core Business Systems Executive Steering Committee should merge the PSMS Prototype and other ETA-managed systems development projects with related BSM Program projects. The purpose of this merger would be to provide improved oversight and project management controls and to comply with stated goals of centrally managing the IRSí systems development activities.
If IRS management decides to allow the ETA Office to continue independent systems development activities, an approved systems development life cycle process and project management controls should be implemented and enforced. Also, the Commissioner, Wage and Investment Division, should require the contractor to provide additional supporting information on hours worked in the periodic status reports and payment vouchers, to help assure that payments are for only authorized work.
Managementís Response: IRS management responded that they would:
IRS managementís complete response to the draft report is included as Appendix IV.
Office of Audit Comment: We believe that managing systems development projects outside the CIO organization is inconsistent with the IRS Organization Blueprint 2000, which consolidates all systems development activities under the CIO. Conducting ad hoc projects or prototypes outside the CIO organization increases the risk of inconsistent and ineffective project management processes and fragmented systems modernization initiatives, which could lead to delays, cost overruns and rework.
IRS managementís response has been incorporated into the report where appropriate, and the full text of the response is included as Appendix IV. In addition, Office of Audit comments on IRS managementís response have been included in the report and at the end of Appendix IV (page 29).