Controls Over the Development of the Practitioner Secure Messaging System Prototype Should Be Improved
December 2000
Reference Number: 2001-20-022
This report has cleared the Treasury Inspector General for Tax Administration disclosure review process and information determined to be restricted from public release has been redacted from this document.
December 27, 2000
MEMORANDUM FOR COMMISSIONER ROSSOTTI
FROM: Pamela J. Gardiner /s/ Pamela J. Gardiner
Deputy Inspector General for Audit
SUBJECT: Final Audit Report - Controls Over the Development of the Practitioner Secure Messaging System Prototype Should Be Improved
This report presents the results of our review of the Internal Revenue Service’s (IRS) development of the Practitioner Secure Messaging System (PSMS) Prototype. In summary, IRS’ Electronic Tax Administration (ETA) management developed the PSMS Prototype to support the design of a full-scale system that will provide a secure Internet environment for tax practitioners and the IRS to exchange tax information. The purpose of the Prototype is to provide information (such as lessons learned) to the related Business Systems Modernization Program Project that is building the full-scale secure messaging system. However, the Prototype’s project management, oversight and spending controls need improvement.
IRS management responded to the recommendations presented in the report and is taking corrective actions to address the project management and spending control issues. However, IRS management did not agree with our recommendation to move the PSMS Prototype and similar ETA systems development initiatives to the Chief Information Officer’s (CIO) organization. We believe managing systems development initiatives outside the CIO organization is inconsistent with the IRS Organization Blueprint 2000, which consolidates all systems development activities under the CIO. Conducting ad hoc projects or prototypes outside the CIO organization increases the risk of inconsistent and ineffective project management processes and fragmented systems modernization initiatives, which could lead to delays, cost overruns and rework.
IRS management’s response has been incorporated into the report where appropriate, and the full text of the response is included as Appendix IV. In addition, Office of Audit comments on IRS management’s response have been included in the report and at the end of Appendix IV (page 29).
Copies of this report are also being sent to the IRS managers who are affected by the report recommendations. Please contact me at (202) 622-6510 if you have questions, or your staff may call Scott Wilson, Associate Inspector General for Audit (Information Systems Programs), at (202) 622-8510.
The Prototype Project Management Controls Can Be Strengthened
Appendix I – Detailed Objectives, Scope, and Methodology
Appendix II – Major Contributors to This Report
Appendix III – Report Distribution List
Appendix IV – Management’s Response to the Draft Report
The Internal Revenue Service (IRS) Restructuring and Reform Act of 1998 (RRA 98) requires the IRS to provide electronic tax account information to taxpayers who electronically file their income tax returns. The IRS’ Electronic Tax Administration (ETA) Office started the Practitioner Secure Messaging System (PSMS) Prototype Project in December 1998 to develop a system that allows tax practitioners to use the Internet to request actions or information on their clients’ tax accounts.
The overall objectives of this audit were to determine whether the PSMS Prototype was managed using sound project management controls and whether the PSMS Prototype was coordinated with the IRS Business Systems Modernization (BSM) Program, which is developing new IRS computer systems.
Results
The PSMS Prototype is the IRS’ first system that uses the Internet to directly interact with the public to exchange taxpayer information. It is a research and development project with the purpose of determining the most productive way to securely receive and respond to tax practitioner requests over the Internet and to provide lessons learned to the IRS’ full-scale secure messaging project. Some of the lessons learned to date include identifying: a lack of technical knowledge among tax practitioners about the Internet, conflicts between the tax practitioners’ wide variety of computer hardware and software configurations and the PSMS Prototype’s software, and technical problems with Internet processing and security software.
Although these lessons learned will certainly benefit the overall modernization effort, we identified several opportunities to improve the control and oversight of the PSMS Project.
Development of the Prototype Outside the Business Systems Modernization Program Is Inconsistent With Prior Audit Recommendations
and the Internal Revenue Service Organization BlueprintThe PSMS Prototype is currently being developed by the ETA Office in the Wage and Investment Division. This management approach conflicts with the IRS’ response to prior audit recommendations and the IRS organization blueprint, which suggest that systems development activities be centrally managed. Specifically:
Because the PSMS Prototype provides new Customer Service functionality and includes the development of a new system that implements new technology, we believe the BSM Program in the CIO organization should control the PSMS Project. The BSM Program is currently responsible for new systems development and is developing a secure messaging system with objectives similar to the PSMS Prototype. Inclusion of the Project in the BSM Program would also provide management control and oversight consistent with that of other systems modernization activities. ETA and BSM Program management did not combine the two projects because Prototype development was already underway and moving the Prototype to BSM management was believed to be inefficient. The ETA Office has other systems development projects underway (for example, the Employer Identification Number Prototype), which may also warrant oversight by the BSM Program.
The Prototype Project Management Controls Can Be Strengthened
Basic project management controls (such as preparing a business case, detailed project work schedules, and interim milestone dates) were not used to help identify the complexity of the PSMS Project and address potential implementation problems. ETA management indicated that they viewed the PSMS Prototype as a short-lived part of a systems development life cycle and, therefore, did not implement some basic project management controls. Completion of the PSMS Prototype was delayed from June 2000 to September 2001, due in part to the lack of effective project management controls. In addition, the authorized costs increased from approximately $368,000 to $2.5 million.
The Prototype Project Spending Controls Can Be Improved
Review of the contractor’s status reports and billing records indicated they did not always contain accurate information and sufficient detail for ETA management to verify the accuracy of the bills. ETA management had not effectively followed up on insufficient detail on the contractor’s periodic billing vouchers. Therefore, management had not identified inaccurate information in the billing vouchers and could not be sure that the IRS paid for only authorized work.
Summary of Recommendations
The Core Business Systems Executive Steering Committee should merge the PSMS Prototype and other ETA-managed systems development projects with related BSM Program projects. The purpose of this merger would be to provide improved oversight and project management controls and to comply with stated goals of centrally managing the IRS’ systems development activities.
If IRS management decides to allow the ETA Office to continue independent systems development activities, an approved systems development life cycle process and project management controls should be implemented and enforced. Also, the Commissioner, Wage and Investment Division, should require the contractor to provide additional supporting information on hours worked in the periodic status reports and payment vouchers, to help assure that payments are for only authorized work.
Management’s Response: IRS management responded that they would:
IRS management’s complete response to the draft report is included as Appendix IV.
Office of Audit Comment: We believe that managing systems development projects outside the CIO organization is inconsistent with the IRS Organization Blueprint 2000, which consolidates all systems development activities under the CIO. Conducting ad hoc projects or prototypes outside the CIO organization increases the risk of inconsistent and ineffective project management processes and fragmented systems modernization initiatives, which could lead to delays, cost overruns and rework.
IRS management’s response has been incorporated into the report where appropriate, and the full text of the response is included as Appendix IV. In addition, Office of Audit comments on IRS management’s response have been included in the report and at the end of Appendix IV (page 29).
The overall objectives of this audit were to determine whether the Practitioner Secure Messaging System (PSMS) Prototype was managed using sound project management controls and whether the PSMS Prototype was coordinated with the Internal Revenue Service’s (IRS) Business Systems Modernization (BSM) Program development activities. The audit work was performed between May and August 2000 at the IRS National Headquarters in New Carrollton, Maryland. We interviewed appropriate Electronic Tax Administration (ETA), Information Systems (IS), and BSM Office managers. We also reviewed systems development documents prepared by the IRS and PSMS Prototype contractor. This audit was performed in accordance with Government Auditing Standards.
Details of our audit objectives, scope, and methodology are presented in Appendix I. Major contributors to this report are listed in Appendix II.
The IRS Restructuring and Reform Act of 1998 (RRA 98) requires the IRS to provide electronic tax account information to taxpayers who electronically file their income tax returns. In early 1998, the National Association of Enrolled Agents (NAEA) proposed allowing its members to use electronic mail (e-mail) for sending information to the IRS to resolve their clients’ tax issues. The IRS ETA Office, in the Wage and Investment Division, formed a work group in July 1998 to determine the proposal’s feasibility and started the PSMS Prototype Project in December 1998.
ETA management initiated the PSMS Prototype as a research and development project to:
Around the time that ETA management started the PSMS Prototype Project, the IRS started renewing its BSM efforts (previously called Tax Systems Modernization) to provide dedicated management to acquire modernized systems, which deliver world class solutions to business customers. The IRS awarded the Prime Systems Integration Services (Prime) Contract in December 1998 and started the BSM Program in June 1999. Key points about the BSM Office include:
One of the projects being developed by the BSM Program is called Assisted e-Services, which is developing a secure messaging system that will allow authorized tax practitioners to submit taxpayer account-related inquiries directly to the IRS via the Internet. An IRS Customer Service Representative (CSR) will issue an electronic response to the inquiry.
The PSMS Prototype is the IRS’ first system that uses the Internet to directly interact with the public to exchange tax information by allowing tax practitioners and IRS CSRs to submit and retrieve secure Internet messages. The PSMS Prototype includes the security and processing controls required to protect the privacy of the information, authenticate the users, and manage the requests and replies. The PSMS Prototype uses established Internet security techniques and commercial off-the-shelf products to identify and authenticate the tax practitioners and IRS personnel who use the system and to protect taxpayers’ information from unauthorized disclosures.
Tax practitioners started testing PSMS Prototype implementation procedures in February 2000. As of August 14, 2000, 53 tax practitioners (out of 104 invited to participate in the Prototype) were testing or had completed the tests and started to send inquiries about their clients’ tax accounts. The purpose for developing the PSMS Prototype is to provide information to the IRS’ Assisted e-Services Project, which includes a secure messaging component. ETA management prepared a plan to gather Prototype results that include user satisfaction statistics, suggestions for improvement, and lessons learned. For example, the PSMS Prototype has identified:
The lessons learned will benefit the overall IRS systems modernization effort and should allow the Assisted e-Services Project to avoid or be better prepared to deal with similar problems.
However, the audit identified the following areas for improvement:
Development of the Prototype Outside the Business Systems Modernization Program Is Inconsistent With Prior Audit Recommendations and the Internal Revenue Service Organization Blueprint
The PSMS Prototype is currently being developed by the ETA Office in the Wage and Investment Division along with other systems development projects (e.g., the Employer Identification Number Prototype). This management approach conflicts with prior audit recommendations and the IRS organization blueprint, which suggest that all systems development activities be managed centrally. Specifically:
On January 26, 1998, the IRS Commissioner replied that he intended "to address these issues in the coming months."
To ensure that the IRS implemented required systems modernization planning and control procedures, the Treasury and General Government Appropriations Act of 1998 required the IRS to submit to the Congress an approved expenditure plan for capital investment funds (called the Information Technology Investment Account, ITIA). In addition to establishing procedures for the approval of IRS modernization funds, this Act authorized general operations funds for the IRS and provided that "…none of the funds under this heading [IS operations], …may be obligated …to implement the Internal Revenue Service’s Modernization Blueprint…." The Congress did not indicate that it changed its intent for obligations from either of these funds when it passed subsequent appropriations acts.
The PSMS Prototype provides new Customer Service functionality and does not directly support existing electronic filing operations. The Project has the characteristics of a systems modernization project because it implements new technology and processes (e.g., Internet transactions and related security controls) for an IRS business requirement (e.g., responding to tax account requests).
In September 1999, after PSMS Prototype development had started, the BSM Program started the Assisted e-Services Project to develop a full-scale secure messaging system that will be similar to the PSMS Prototype. ETA and BSM Program management did not combine the two Projects because Prototype development was already underway and moving the Prototype to BSM management was believed to be inefficient. Rather than combining the Projects, management assigned the two PSMS Prototype Team Leaders as the Assisted e-Services Project Product Owners (the modernization term for the systems’ users) to transfer their knowledge. However, as of June 2000, the PSMS Prototype team had not documented the Prototype results and ETA management had extended the PSMS Prototype development until September 2001, to collect additional information.
ETA management views the PSMS Prototype as a research and development effort to learn as much as possible about secure messaging and will provide its results to the Assisted e-Services team. Although they agreed that a prototype is part of an overall system development project, they drew a distinction between prototype development and systems development. The ETA Office managed the PSMS Project with IS managers providing support for the Prototype development but not project management. In addition, IRS management did not formally oversee the PSMS Prototype Project with an executive steering committee.
The ETA Office included the funds to develop the PSMS Prototype in its Fiscal Year (FY) 1999 and 2000 operations budget requests. These requests stated that the funds were for private sector contracts and agreements to continue ETA’s activities. As of June 9, 2000, the Project had cost at least $1.2 million. In addition, ETA management has budgeted an additional $1.3 million to be spent on the Project, including $567,000 for the remainder of FY 2000 and $755,000 in FY 2001.
The BSM Program should control the PSMS Prototype. This would allow the Project to (1) more closely comply with the Congress’ intent that the IRS use only ITIA funds for systems modernization activities, (2) conform to the IRS Organization Blueprint 2000 that centralizes all systems development activities, and (3) provide consistent controls and oversight over the development activities. With BSM Program control, the PSMS Prototype project could be eligible for funding from the ITIA.
The Prototype Project Management Controls Can Be Strengthened
The Office of Management and Budget (OMB) Circular A-130, Management of Federal Information Resources, requires all agencies to establish a control process to monitor performance of information systems investments and makes the CIO responsible for implementing this investment management and oversight process. The IRS has historically required project management procedures and a systems development life cycle methodology for all systems development projects.
The ETA Office managed the PSMS Prototype Project but did not implement formal systems life cycle procedures. During PSMS Prototype development, the IS organization provided support but did not assign a project manager to run the Project. Discussions with ETA management indicated that they viewed the PSMS Prototype as a short-lived part of a systems development life cycle and relied on the contractor to manage the PSMS Project. Therefore, they did not implement certain basic project management controls. For example, the Project Team did not prepare a business case or detailed project work breakdown schedules, including interim milestone dates. In addition, ETA management did not conduct formal milestone reviews of documents such as the Detailed System Description to help identify the complexity of the Project and address potential implementation problems. This ultimately contributed to PSMS Project delays and increased costs.
The audit identified the following PSMS Prototype development problems:
Completion of the PSMS Prototype was delayed from June 2000 to September 2001, due in part to additional development efforts to correct identified security and functionality problems. The authorized costs also increased from approximately $368,000 to $2.5 million (including $755,000 budgeted in FY 2001 operations funds).
The Prototype Project Spending Controls Can Be Improved
OMB Circular A-130 requires a process to be established to monitor performance of information systems investments, including budget and spending controls. Also, the Federal Managers’ Financial Integrity Act of 1982 (FMFIA) requires Federal agencies to implement internal accounting and administrative controls that provide reasonable assurances that expenditures are recorded and accounted for to maintain accountability over the assets.
Estimates of the total cost or time to develop the PSMS Prototype were not prepared because the Project was considered a prototype that involved uncertainty. In addition, billing information provided by the contractor made it difficult for management to assure that the contractor was paid for only work authorized through the several contract modifications issued by the IRS. Specifically, we found:
The Work Request authorized payment to the contractor for up to a certain number of labor hours to accomplish these tasks. We estimated that the contractor’s work would cost about $152,000. In addition, the hardware and software needed to develop and operate the PSMS Prototype cost the IRS about $36,000, and IRS staff costs were approximately $180,000. Therefore, we estimate that the PSMS Prototype was initially authorized to cost approximately $368,000.
The two modifications authorized payment for up to a certain number of labor hours, which we estimated would cost approximately $1.6 million.
Through June 9, 2000, the IRS had spent about $1.2 million for contractor support to develop and operate the PSMS Prototype, IRS labor, and acquisition of necessary hardware and software. In addition, the IRS budgeted approximately $567,000 for the remainder of FY 2000 and $755,000 for FY 2001 bringing the total Project cost to about $2.5 million (including the $1.6 million for authorized work request modifications).
ETA management could not assure that the contractor was paid for only authorized work because they had not effectively followed up with the contractor to obtain details left out of the periodic billing vouchers. Therefore, ETA management had not identified inaccuracies in the information included in the billing vouchers. The contractor is paid on the basis of the work identified in PSMS Prototype status reports and the amount billed on the payment vouchers. ETA management and IRS contract administration personnel routinely review and approve these documents before reimbursing the contractor for completed work. However, the status reports could not be reconciled to the payment vouchers for the hours worked. The status reports identified the work accomplished and the total hours billed during the period but did not break the total down by task. The contractor’s payment vouchers included the total hours billed for multiple IRS projects but did not break the total down for each project (e.g., PSMS Prototype).
During the audit, we questioned whether the IRS had inappropriately paid the primary contractor up to $169,000 to correct programming design and development errors. Previously, the contractor’s executive managers agreed in a meeting with IRS executives to not bill the IRS for the hours that their personnel worked to correct problems identified by IRS testing. However, during the period from December 1999 through January 2000, the contractor continued to bill the IRS for work completed. Many of the tasks identified on the contractor’s status reports for this period could be associated with the redesign (e.g., testing and implementing changes).
In response to our questions about the "billable" versus "unbillable" hours, the contractor reported that additional personnel were assigned to correct the problems and 475 work hours were not billed. According to the contractor’s status reports, it billed the IRS for 1,955 hours during the same period.
Comparison of these reports to the two payment vouchers that the contractor submitted for the same period indicated that "unbillable" hours might have been billed. ETA management followed up with the contractor and indicated that differences occurred because the contractor’s internal system did not report accurate information. The following information was not accurate:
In addition, the format of the payment vouchers and status reports did not provide sufficient detailed information to assure that IRS was paying for only authorized work. For example:
ETA management could improve their control over the Project’s cost and better ensure the accuracy of the contractor’s payment vouchers if the status reports and payment vouchers provided more detailed, project-specific information.
Recommendations
Management’s Response: The Commissioner, Wage and Investment Division did not agree that PSMS or any other ETA research and development initiative should be merged under the BSM program. He stated that IRS management has created an investment decision management process that allows the identification, ranking, and selection of large, medium, and small-scale improvement projects. This allows medium and small-scale improvement projects to proceed in tandem with the modernization effort [outside the CIO’s organization].
All further enhancements of PSMS will be subjected to software development lifecycle activities. ETA and IS management will develop a project management plan for the PSMS Prototype. In addition, ETA management has hired a contractor to ensure project management controls are used for future ETA projects.
Office of Audit Comment: The investment decision management process described above was designed to rank the IRS’ overall business needs to determine which projects would be funded. We believe the intent of this process is that all prioritized and funded projects to be managed centrally by the CIO, not by separate systems development groups in the IRS’ business units.
In addition, management has already hired a contractor under the Prime Contract to assist the IRS in implementing a systems development life cycle approach (called the Enterprise Life Cycle). It is unclear why the IRS would need to hire another contractor to ensure improved project management controls are used for future ETA projects.
Therefore, the Office of Audit still believes the PSMS Prototype and other ETA-managed systems development projects should not be managed by the business unit organizations, such as the Wage and Investment Division. Management of systems development activities in the CIO organization, where the proper skills and contracts already exist, would seem to be more efficient for the IRS and help prevent wasted funds.
Finally, management’s response cites Internal Revenue Manual 2553.23 (Small-Scale Applications Handbook) as the software development life cycle procedure to be followed for further enhancements. This Handbook applies to small systems development projects that (1) will cost less than one staff year to develop and (2) are not tax related projects. The PSMS Prototype does not meet the criteria for small-scale applications as it is a multi-year systems development project that is used to transmit, manage, and store tax information. When the PSMS Prototype development was initiated, Document 7924, Enhanced Systems Development Life Cycle, and Document 7362, Software Prototyping Methodology, provided guidelines for prototype development. Currently, the Enterprise Life Cycle (ELC) defines the policies, procedures, responsibilities, and standards required for IRS business systems modernization projects. The ELC incorporates major high-level milestones that can be tailored as appropriate.
Management’s Response: IRS management plans to develop a shut-down strategy for the end of the PSMS Prototype, which will include written instructions for accessing electronic records after the end of the PSMS Prototype.
Management’s Response: IRS management will require the PSMS contractor to provide more detailed information for future work, and on status reports and payment vouchers.
IRS management’s complete response to the draft report is included as Appendix IV.
ETA management developed the PSMS Prototype to support the design of a full-scale secure messaging application. The PSMS Prototype Project has identified a number of lessons learned that will be useful to the related BSM Program Assisted e-Services Project. However, project management and spending controls can be improved.
Appendix I
Detailed Objectives, Scope, and Methodology
The overall objectives of this audit were to determine whether the Practitioner Secure Messaging System (PSMS) Prototype was managed using sound project management controls and whether the PSMS Prototype was coordinated with the Internal Revenue Service’s (IRS) Business Systems Modernization (BSM) Program development activities.
Appendix II
Major Contributors to This Report
Scott E. Wilson, Associate Inspector General for Audit (Information Systems Programs)
Gary Hinkle, Director
Danny Verneuille, Audit Manager
Frank Greene, Senior Auditor
Mark Carder, Auditor
Barbara Sailhamer, Auditor
Linda Screws, Auditor
Appendix III
Deputy Commissioner Modernization C:DM
Deputy Commissioner Operations C:DO
Chief Financial Officer CFO
Chief Information Officer IS
Chief, Agency-Wide Shared Services A
Commissioner, Wage and Investment Division W
Deputy Chief Information Officer, Operations IS
Deputy Chief Information Officer, Systems IS
Director, Business Systems Modernization B
Director, Electronic Tax Administration W:E
Director, Information Resources Management IS:IR
Director, Legislative Affairs CL:LA
Director, Office of Program Evaluation and Risk Analysis M:O
Director, Procurement A:P
Director, Systems Development IS:SD
Director, Individual Electronic Filing W:E:IEF
Office of Chief Counsel CC
Office of Management Controls CFO:A:M
National Taxpayer Advocate TA
Audit Liaisons: Agency-Wide Shared Services, Management Controls Coordinator A
Business Systems Modernization Office B:E
Director, Electronic Tax Administration W:E
Office of Chief Financial Officer Act Compliance CFO:F:C
Office of Information Systems Program Oversight IS:IR:O
Appendix IV
Management’s Response to the Draft Report
The response has been removed due to its size. To see the complete response, please go to the Adobe PDF version of the report on the TIGTA Public Web Page.
Office of Audit Comments
The following information is provided to clarify statements contained in the Internal Revenue Service’s (IRS) management response dated November 28, 2000.
IRS management stated in the response that the prototyping process must remain flexible to be effective and that finalizing requirements would freeze the design and prevent changes indicated by the lessons learned. However, current IRS system development guideline documents address prototype development activities in a different light: