The Internal Revenue Service (IRS) Restructuring and Reform Act of 1998 (RRA 98) requires the IRS to provide electronic tax account information to taxpayers who electronically file their income tax returns. The IRS’ Electronic Tax Administration (ETA) Office started the Practitioner Secure Messaging System (PSMS) Prototype Project in December 1998 to develop a system that allows tax practitioners to use the Internet to request actions or information on their clients’ tax accounts.

The overall objectives of this audit were to determine whether the PSMS Prototype was managed using sound project management controls and whether the PSMS Prototype was coordinated with the IRS Business Systems Modernization (BSM) Program, which is developing new IRS computer systems.

The PSMS Prototype is the IRS’ first system that uses the Internet to directly interact with the public to exchange taxpayer information. It is a research and development project with the purpose of determining the most productive way to securely receive and respond to tax practitioner requests over the Internet and to provide lessons learned to the IRS’ full-scale secure messaging project. Some of the lessons learned to date include identifying: a lack of technical knowledge among tax practitioners about the Internet, conflicts between the tax practitioners’ wide variety of computer hardware and software configurations and the PSMS Prototype’s software, and technical problems with Internet processing and security software.

Although these lessons learned will certainly benefit the overall modernization effort, we identified several opportunities to improve the control and oversight of the PSMS Project.

The PSMS Prototype is currently being developed by the ETA Office in the Wage and Investment Division. This management approach conflicts with the IRS’ response to prior audit recommendations and the IRS organization blueprint, which suggest that systems development activities be centrally managed. Specifically:

• In July 1995 and again in February 1998, the General Accounting Office (GAO) issued reports recommending the IRS centralize management and control of all systems development activities under the Chief Information Officer (CIO) to enforce compliance with established system development processes and product standards. The IRS responded that the Associate Commissioner (now called Director, Business Systems Modernization) is "responsible for all aspects of modernization program planning and management, budget formulation and execution, and information systems development and management." Subsequently, the IRS established the BSM Program, which is governed and overseen by the Core Business Systems Executive Steering Committee, to provide dedicated management to acquire modernized systems.
• The IRS Organization Blueprint 2000 states that the CIO "manages all IRS information technology (IT) resources and assumes responsibility for delivering and maintaining modernized IT systems throughout the IRS." The future IRS organization will consolidate all employees performing information systems-related work into the Information System organization under the direction of the CIO. This includes the BSM Program.

Because the PSMS Prototype provides new Customer Service functionality and includes the development of a new system that implements new technology, we believe the BSM Program in the CIO organization should control the PSMS Project. The BSM Program is currently responsible for new systems development and is developing a secure messaging system with objectives similar to the PSMS Prototype. Inclusion of the Project in the BSM Program would also provide management control and oversight consistent with that of other systems modernization activities. ETA and BSM Program management did not combine the two projects because Prototype development was already underway and moving the Prototype to BSM management was believed to be inefficient. The ETA Office has other systems development projects underway (for example, the Employer Identification Number Prototype), which may also warrant oversight by the BSM Program.

Basic project management controls (such as preparing a business case, detailed project work schedules, and interim milestone dates) were not used to help identify the complexity of the PSMS Project and address potential implementation problems. ETA management indicated that they viewed the PSMS Prototype as a short-lived part of a systems development life cycle and, therefore, did not implement some basic project management controls. Completion of the PSMS Prototype was delayed from June 2000 to September 2001, due in part to the lack of effective project management controls. In addition, the authorized costs increased from approximately $368,000 to $2.5 million.

Review of the contractor’s status reports and billing records indicated they did not always contain accurate information and sufficient detail for ETA management to verify the accuracy of the bills. ETA management had not effectively followed up on insufficient detail on the contractor’s periodic billing vouchers. Therefore, management had not identified inaccurate information in the billing vouchers and could not be sure that the IRS paid for only authorized work.

The Core Business Systems Executive Steering Committee should merge the PSMS Prototype and other ETA-managed systems development projects with related BSM Program projects. The purpose of this merger would be to provide improved oversight and project management controls and to comply with stated goals of centrally managing the IRS’ systems development activities.

If IRS management decides to allow the ETA Office to continue independent systems development activities, an approved systems development life cycle process and project management controls should be implemented and enforced. Also, the Commissioner, Wage and Investment Division, should require the contractor to provide additional supporting information on hours worked in the periodic status reports and payment vouchers, to help assure that payments are for only authorized work.

Management’s Response: IRS management responded that they would:

• Not merge the PSMS Prototype or any other ETA research and development initiatives under the BSM program. IRS management will use software development life cycle activities for further PSMS Prototype enhancements, develop a project management plan, and hire a contractor to ensure project management controls are used for future ETA projects.
• Develop a shutdown strategy for the end of the PSMS Prototype and write instructions for accessing electronic records after the end of the PSMS Prototype.
• Require the contractor to provide more detailed cost information for future work, and on status reports and payment vouchers.

IRS management’s complete response to the draft report is included as Appendix IV.

Office of Audit Comment: We believe that managing systems development projects outside the CIO organization is inconsistent with the IRS Organization Blueprint 2000, which consolidates all systems development activities under the CIO. Conducting ad hoc projects or prototypes outside the CIO organization increases the risk of inconsistent and ineffective project management processes and fragmented systems modernization initiatives, which could lead to delays, cost overruns and rework.

IRS management’s response has been incorporated into the report where appropriate, and the full text of the response is included as Appendix IV. In addition, Office of Audit comments on IRS management’s response have been included in the report and at the end of Appendix IV (page 29).