The overall objective of this review was to determine whether controls over the lockbox program in an Atlanta bank provided reasonable assurance that taxpayer payments were processed in accordance with established guidelines. To achieve our objective, we:

• Reviewed two judgmental samples totaling 337 remittances received by the bank during April and May 2000. We reviewed one sample of 150 remittances to determine whether they were timely deposited and accurately posted to taxpayers’ accounts. We reviewed another sample of 187 remittances to determine if they were properly overstamped with "United States Treasury" as required.
• Reviewed a judgmental sample of 228 tax returns received by the bank during May 2000 to determine whether they were sorted in accordance with established guidelines.
• Held discussions with local lockbox bank (Bank of America) and Internal Revenue Service (IRS) officials and reviewed procedures and reports to determine whether the bank correctly performed other required services, such as shipping tax returns and monitoring bank activities.
• Visited the local lockbox bank on May 25, 2000, to observe and evaluate the controls over the physical security of taxpayer payments, tax returns, and other taxpayer data.

Audit work was performed at the Atlanta Submission Processing Center (ATSPC) and the Atlanta lockbox bank from May 2000 through June 2000. The audit was performed in accordance with Government Auditing Standards.

Major contributors to this report are listed in Appendix I. Appendix II contains the Report Distribution List.

The IRS lockbox program consists of commercial banks that have contracted with the Financial Management Service (FMS), another government agency, to process tax payments. This program was designed to accelerate the deposit of tax payments by having taxpayers send their payments to commercial banks rather than to the IRS. According to the IRS, from January through April 2000 this bank processed over 3.4 million tax payments totaling over $17 billion. The bank also received over 1 million tax returns.

The Statement of Work (SOW) and Lockbox Processing Guidelines are agreements between the FMS and the bank detailing the specific services that the bank will perform for the IRS. These services include tasks that the IRS would otherwise have to do, such as ensuring checks are made payable to "Internal Revenue Service," "IRS," or the "United States Treasury," providing security over the remittances and taxpayer data, and creating computer tapes of payment transactions that are sent to the IRS. The bank also receives, sorts, and ships tax returns to the IRS.

The IRS is responsible for providing oversight of bank activities to ensure the lockbox banks adhere to the procedures in the SOW.

The IRS provided adequate oversight of bank activities by conducting required reviews such as on-site visitations and monthly performance reviews.

The bank timely deposited all 150 tax payments that we reviewed. Ninety-nine percent of those payments also posted correctly to taxpayers’ accounts. While these are significant accomplishments, opportunities exist to improve the Atlanta lockbox program in the following areas:

• Bank security (to further minimize the risk of theft and unauthorized actions by bank personnel).
• Accurate sorting of tax returns (to minimize processing costs and improve customer service).

The bank was contractually required to provide adequate security, equipment, and facilities to safeguard all taxpayer payments and data that it received. During our visit to the bank, we found that the bank complied with some of the security requirements. For example:

• Security cameras were strategically positioned to monitor the bank entrance, processing areas, employee locker rooms, and loading docks.
• Police background checks were conducted for all 25 employees reviewed.
• Unscheduled desk checks of employees were conducted every week as required.

Our visit to the bank identified the following security risks:

• On May 8, 2000, a bank manager conducting an unannounced desk check found 14 checks from 12 taxpayers totaling over $5.6 million that had not been deposited. The checks were all dated around April 15, 2000, and were with requests for extensions to file tax returns.

• Our analysis of 25 terminated bank employees showed they had active passwords to the lockbox bank computer system used to process taxpayer information for extended periods of time after termination. Bank personnel indicated that it was too time consuming to delete employees from the computer system between peak periods.
• We observed two individuals in restricted areas of the bank without an identification badge. Neither security personnel nor bank managers challenged these employees.
• We identified 7 of 187 checks, totaling $13,150, that were not made payable to or stamped with "United States Treasury." Although this is a low error rate (4 percent), the risk of theft is increased when checks are not stamped as required. There were two thefts from the bank during Fiscal Year 2000. Both thefts involved money orders that were not stamped, one for $250 and the other for $700, and both are being prosecuted.
• We observed a bank manager giving a deposit to a bank courier who did not have proper identification. The bank manager stated that he/she knew the courier by sight. However, the individual’s employment status with the courier service could have changed. We reported this incident to both the bank and IRS management, and the manager was subsequently reprimanded.

We also determined that security weaknesses existed at the IRS when IRS employees did not sign for lockbox bank packages containing tax returns, unprocessed tax payments, and other IRS documents upon arrival at the ATSPC. The SOW requires the courier to obtain a signature from the IRS employee accepting the packages and add the time delivered to account for and verify the timeliness of the package. However, ATSPC personnel were not aware of this requirement.

The bank and ATSPC personnel have not implemented or enforced all existing security requirements. Inadequate security over personnel, tax returns, and tax payments can lead to embezzlements and/or unauthorized disclosure of taxpayer information. As stated previously, during the period January through April 2000, the bank processed over 3.4 million tax payments totaling over $17 billion that were vulnerable to theft. The bank also handled over 1 million tax returns that were vulnerable to unauthorized use and disclosure of taxpayer information.

1. The Commissioner, Wage and Investment Division, should ensure that all required security measures are implemented and enforced.

Management’s Response: The IRS responded that, "We directed all Lockbox Coordinators to complete their monthly reviews until implementation of the new Quality Review Process. The first phase of the Quality Review Process began on January 15, 2001. This phase includes a procedural and administrative review of lockbox processing from the time the lockbox site receives the mail to the time the lockbox site forwards the package to the SPC and the money is deposited.

"The second phase will focus on reviewing the process from the time the SPC receives the package to just before the transaction posts to the taxpayer’s account. The National Deposit Accuracy Measure will then see if the deposit posted correctly to the taxpayer’s account."

The Bank Did Not Correctly Sort All Tax Returns

The SOW and the Lockbox Processing Guidelines describe the criteria for sorting the various types of tax returns. For example, returns with tax payments are to be sorted separately from returns that do not have tax payments. From January through April 2000, this bank was paid $842,000 to sort over 1 million tax returns.

Our review of a judgmental sample of 228 tax returns received at the ATSPC between May 24, and May 31, 2000, showed that 87 of the returns (38 percent) were sorted incorrectly.

Bank personnel stated that bank employees may not have understood the sorting requirements and may not have been adequately trained in this area. When returns are not properly sorted, the IRS must spend additional resources to correctly sort them, which could result in processing delays.

Recommendation

2. The Commissioner, Wage and Investment Division, should ensure that the bank correctly sorts tax returns.

Management’s Response: The IRS responded that, "The Headquarters Lockbox staff will research the feasibility of having SPC employees who are knowledgeable in sorting returns train employees at the Lockbox sites prior to the April peak. The SPC Lockbox Coordinators and the Headquarters Lockbox staff will review the April Peak On-Site Review reports to determine the benefits of the training. If the return sort error rate remains high, they will convene a task force to reanalyze the return sort process and develop other initiatives for improvement."

The Atlanta lockbox bank timely deposited all of the reviewed tax payments. However, security at the bank should be improved. Also, additional emphasis should be placed on the quality of the tax returns sorted by the bank.

Walter E. Arrison, Associate Inspector General for Audit (Wage and Investment Income Programs)

M. Susan Boehmer, Director

Deborah H. Glover, Audit Manager

Gregory A. Dix, Senior Auditor

Gail Yorgason, Senior Auditor

Robert A. Baker, Auditor

Arnita F. Brown, Auditor

Andrea M. Hayes, Auditor

Commissioner N:C

Director, Customer Account Services (CAS) W:CAS

Director, Submission Processing W:CAS:SP

Director, Submission Processing, Atlanta W:CAS:SP:AT

Director, Legislative Affairs CL:LA

National Taxpayer Advocate TA

Office of Management Controls N:CFO:F:M

Office of the Chief Counsel CC

Director, Office of Program Evaluation and Risk Analysis N:ADC:R:O

Audit Liaison:

The response was removed due to its size. To see the complete response, please go to the Adobe PDF version of the report on the TIGTA Public Web Page.