Employee Background Investigations Were Normally Completed;
However, the Contractor Employee Background Investigation Program Needs
Improvement
February 2003
Reference
Number: 2003-20-049
This report has cleared the Treasury Inspector General for Tax Administration disclosure review process and information determined to be restricted from public release has been redacted from this document.
February
28, 2003
MEMORANDUM FOR CHIEF, AGENCY-WIDE SHARED SERVICES
FROM: Gordon C. Milbourn III /s/ Gordon C.
Milbourn III
Acting Deputy Inspector
General for Audit
SUBJECT: Final
Audit Report - Employee Background Investigations Were
Normally Completed; However, the Contractor Employee Background Investigation
Program Needs Improvement (Audit #
200220009)
This
report presents the results of our review of the Background Investigation
Program. The overall objective of this
review was to determine the effectiveness of the Background Investigation
Program administration for both Internal Revenue Service (IRS) employees and
contractor employees.
The IRS requires its
employees and those of contractors working for the IRS to have background
investigations to ensure the honesty and integrity of individuals, due to the
sensitive nature of the tax information being handled. The IRS’ Agency-Wide Shared Services (AWSS)
organization is primarily responsible for completing the background
investigations. The IRS uses the
Department of Agriculture’s Security Entry Tracking System (SETS) as its
database to monitor the status of background investigations. The depth of background investigations
(e.g., full, limited, etc.) depends upon the sensitivity of the information
that the individuals will have access to during their work with the IRS. Employees in high-risk positions and those
holding National Security Clearances are required to have periodic
re-investigations.
In summary, the IRS had
assured that most of the employee background investigations (93 percent) and
re-investigations (96 percent) were completed or in process at the time of our
review. However, we identified several
areas in the Contractor Background Investigation Program that need improvement.
Contractor employee
background investigations conducted by agencies other than the IRS are not
properly controlled. Our review of the 4,380 contractor employees with
identification badges allowing them access to the New Carrollton Federal
Building (NCFB) found that 2,166 (49 percent) did not have any background
investigation information in the SETS.
Of these 2,166 contractor employees, 134 had not filed required tax
returns and 66 had not paid taxes of $688,842 (see Appendix IV). As a result,
management has no assurance that contractor employees have a completed
background investigation that meets all IRS requirements and that contractor
employees are current in their Federal tax obligations, which could be an
indication of their overall trustworthiness and raise concerns about whether
they should be allowed to perform work for the IRS.
Not all Contracting
Officer’s Technical Representatives (COTR) are requesting background
investigations as required. We
determined that 525 (23 percent) of
2,235 contractor employees on whom the IRS should have conducted the
background investigations did not have background investigation information in
the National Background Investigation Center database.
Similarly, we determined
that identification badges are being issued without required background
investigation documentation. For example, we judgmentally sampled badge records on
78 of 777 contractor employees with NCFB identification badges and no record in
the SETS database, and found that only 5 (7 percent) of these badge records had
documentation indicating that a background investigation had been performed.
The SETS does not include
all the information needed to properly manage the Background Investigation
Program. Therefore, stand-alone systems
have been created to supplement the SETS.
For example, the Personnel Security Office (PSO) is currently in the
process of developing and testing a new system which management believes will
be more flexible than the SETS and reduce the need for supplemental
databases. The Office of Technical
Contract Management (TCM) has also created a separate system to track the
status and corresponding costs of background investigations. However, these two new systems track some of
the same information and will not be integrated. Inadequate coordination and communication between the PSO and TCM
organizations have resulted in the AWSS organization spending funds for the
development and maintenance of non-integrated systems.
Finally, the identification
badge system information is not complete and accurate. Our review of the identification badge
system records for 4,380 contractor employees at the NCFB identified 230
records (5 percent) containing data omissions or incorrect data for key pieces
of information (e.g., Social Security Number and contractor company name).
We recommended that the
Chief, AWSS, ensure that all employees and contractor employees have current,
completed background investigations that meet all IRS requirements; management
reports are properly used to monitor timely completion of future background
investigations; and all contractor employees have properly filed their tax returns
and paid their tax obligations. The
SETS and identification badge systems information needs to be complete and
accurate; all contractor employee background investigations should be provided
to NBIC; and a consolidated or integrated system that meets the needs of all
stakeholders needs to be implemented, allowing stand-alone systems to be
eliminated. The Chief, AWSS, also
should ensure that all COTRs use the TCM system; periodic reconciliation of
information is conducted to detect the issuance of contractor employee
identification badges without completion of background investigations; and
training is provided to emphasize background investigation requirements,
employee responsibilities, and the documentation required for contractor
employee identification badge issuance.
Management’s Response: IRS management agreed with the recommendations presented in this report. Planned corrective actions include re-emphasizing background investigation requirements, improving COTR training, improving the identification badge issuance process, monitoring business measures to ensure timely completion of investigations, and establishing a stakeholder project team to assess background investigation program management.
Management’s
complete response to the draft report is included as Appendix VI.
Copies of this
report are also being sent to the IRS managers who are affected by the report
recommendations. Please contact me at
(202) 622-6510 if you have questions or Gary V. Hinkle, Acting Assistant
Inspector General for Audit (Information Systems Programs), at (202) 927-7291.
Background Investigations on
Employees Were Normally Completed
Background Investigations on Contractor Employees Were Not
Properly Completed
Several Systems Have Been Created to Supplement the Security
Entry Tracking System
Identification Badge System Information Is Not Complete and
Accurate
Appendix I – Detailed Objective,
Scope, and Methodology
Appendix II – Major Contributors to
This Report
Appendix III – Report Distribution
List
Appendix IV – Outcome Measures
Appendix V – Glossary of Terms
Appendix VI – Management’s Response to
the Draft Report
Internal Revenue Service (IRS) employees and employees of contractors doing work for the IRS are required to have background investigations to ensure the honesty and integrity of the individuals, due to the sensitive nature of the tax information handled by the IRS. The depth of the background investigations (e.g., full, limited, etc.) depends upon the sensitivity of the information that the individuals will have access to during their work with the IRS.
The IRS’ Agency-Wide Shared Services (AWSS) organization has primary responsibility for completing background investigations and providing access to IRS facilities through the following offices:
· The National Background Investigation Center (NBIC) under the Personnel Security Office (PSO) is responsible for conducting background investigations on IRS and contractor employees.
· The PSO accepts background investigations of contractor employees completed by other government agencies, such as the Department of Defense, the Office of Personnel Management, and the General Services Administration (GSA). These contractor employees are usually in offices outside of National Headquarters and are employed in various positions, including security guard services or cafeteria workers.
· The Real Estate and Facilities Management (REFM) Office is responsible for issuing identification badges to IRS and contractor employees, allowing access to IRS facilities.
Previous reviews of background investigations have reported the following issues:
· The Treasury Inspector General for Tax Administration (TIGTA), formerly the IRS’ Internal Audit function, report, Review of the Service’s Background Investigation Program for ADP Contractors (Reference Number 070605, dated December 1996), stated that the Information Systems Contractor Background Investigation Program was ineffective. The audit found that 532 (60 percent) of the 888 contractors reviewed did not have background investigations or other acceptable clearances.
· The General Accounting Office (GAO) report, IRS’ Fiscal Year 2001 and 2000 Financial Statements (GAO/GAO-02-414, dated February 2002), stated that while the IRS has not achieved total compliance with the fingerprint requirement check prior to employees entering on duty, significant progress has been made. Of approximately 20,000 employees hired during Fiscal Year (FY) 2001, only 104 began working prior to the IRS’ receipt and evaluation of their fingerprint checks. Furthermore, in their report, Management Report: Improvements Needed in IRS’ Accounting Procedures and Internal Controls (GAO-02-746R, dated July 2002), GAO discussed their analysis of 20,500 records in the database used by the IRS to monitor background investigations, which found 411 records with erroneous or missing data. According to IRS staff, these problems were due to technical limitations in the database and human error.
This audit was conducted in the AWSS functions at the
National Headquarters in Washington, D.C., and New Carrollton, Maryland;
Florence, Kentucky; and the Memphis IRS Campus/Tennessee Computing Center in
Memphis, Tennessee from February through November 2002. This
audit was scheduled as part of the TIGTA’s FY 2002 Annual Plan and was
performed in accordance with Government
Auditing Standards. Detailed
information on our audit objective, scope, and methodology is presented in
Appendix I. Major contributors to the
report are listed in Appendix II. A
Glossary of Terms is presented in Appendix V.
IRS procedures require background investigations on all
employees. Re-investigations are also required periodically for employees in
high-risk positions and those holding a National Security Clearance.
The IRS uses the Department
of Agriculture’s Security Entry Tracking System (SETS) as its background
investigation information tracking database.
We reviewed SETS information as of April 25, 2002, for 43,233 employees
in moderate- or high-risk positions and determined that:
·
A background
investigation was completed on 40,180 employees (93 percent).
·
An investigation was
requested, but not yet completed, on 2,820 employees (6 percent). The majority of the investigations were
completed within 24 months, but some took as long as 52 months.
·
The remaining 233
employees (less than 1 percent) either were new hires that had not yet had an
investigation requested, or were employees who had data in the SETS that
appeared to be erroneous (e.g., a background investigation was shown as
completed on a date in the future).
From
our review of the 43,233 moderate- and high-risk employees, we determined that
3,753 employees met the IRS requirements for periodic background
re-investigation. For these employees,
the SETS information showed that:
·
A current investigation
that meets the IRS re-investigation requirements had been completed on 2,722
employees (73 percent).
·
An investigation was in
process on 867 employees (23 percent).
The majority of the investigations were completed within 24 months, but
some took as long as 52 months.
·
The other 164 employees
(4 percent) had not had an investigation completed in the last 5 years or did
not have an investigation in process.
Therefore, the SETS information indicates that the PSO and
the NBIC have assured that employee background investigations and
re-investigations have generally been completed as required. However, follow-up actions are needed to
assure investigations are completed or requested on the remaining employees due
to the sensitive nature of the tax information handled by the IRS. The investigations were not completed
because there was no timely follow-up on all investigations, nor were there
automatic controls to prevent the entry of obviously erroneous
information. By not providing the PSO background
investigation information on all contractors, the IRS is exposed to the
potential of unauthorized use of information, theft of equipment, and physical
harm to employees.
1.
The Chief, AWSS, should
ensure that follow-up actions are taken to initiate or complete background
investigations on the employees without current, completed investigations;
management reports are properly used to monitor timely completion of future
background investigations; and SETS information is accurately recorded.
Management’s Response:
The Director, Personnel Services, will issue a memorandum to field
Personnel Offices reiterating expectations in managing the Employee Background
Investigation Program. The NBIC will
monitor their business measures to ensure the timely completion of background
investigations. The Associate Director,
Personnel Security and Investigations, will continue a dialog with the Office
of Personnel Management to ensure more timely results on out-sourced
investigations.
Department of the Treasury procedures provide guidelines for
background investigations on contractor employees. The IRS’ Security Investigation Standards provide procedures for
completing background checks on contractor employees, including
re-investigation every 5 years for sensitive positions and a verification of Federal tax filing
history. IRS procedures provide that
the REFM Office will issue identification badges to contractor employees upon
receipt of a completed badge request form.
This form should include the attachment of a memorandum from the PSO
approving the contractor employee’s access to IRS facilities based on a
completed background investigation. Our
review of the Contractor Employee Background Investigation Program identified
several opportunities for improvement that resulted from program
responsibilities being divided among several IRS offices.
Contractor employee background investigations
conducted are not properly controlled
The SETS database is used by the IRS to monitor the
initiation, completion, and type of investigation conducted on contractor
employees. The NBIC inputs information
into the SETS database for the investigations that it completes. However, the database does not contain
information on all contractor employees because investigation requests and the
results of investigations completed by other government agencies are not being
sent to the NBIC.
To quantify the number of
contractor employees without background investigations in the SETS, we compared
the New Carrollton Federal Building (NCFB) identification badge database to the
SETS database and determined that 2,166 (49 percent) of the 4,380 contractor
employees who had been issued NCFB identification badges did not have any
background investigation information in the SETS. We also attempted to obtain information on the contractor
employees at IRS offices outside of Washington, D.C.; however, the IRS could
not provide any information regarding the number of contractor employees and
the completion of background investigations because the information is not
maintained and managed by one IRS office.
Also, the AWSS organization
does not perform any independent analyses, such as comparing the identification
badge records to completed background investigations, to ensure that contractor
employees authorized to enter IRS facilities have obtained proper
clearance. Without the input of all
contractor employee background investigation information into the SETS database
and periodic reconciliation with the identification badge system, the PSO
cannot effectively monitor the program and reduce the risk to IRS personnel and
property. Furthermore, without adequate
controls to monitor the completion of initial background investigations, the
PSO cannot effectively track contractor re-investigations.
Contractor employee tax
filing history is not being verified
IRS guidelines require a verification of contractor employee
Federal tax filing, but this
requirement cannot be verified by other agencies conducting background
investigations because they do not have access to tax filing information. In addition, since the SETS does not
contain background information on all contractor employees, it cannot be used
to identify those contractors that require additional review by the PSO. As a result, management has no assurance
that contractor employees with background investigations completed by other
agencies have properly fulfilled their Federal tax filing requirements.
For
contractor employee background investigations completed by the NBIC over the
last 3 years, the PSO’s review of contractor employee compliance with Federal
tax filing requirements has resulted in delinquent taxes being paid, tax
returns being filed, or some form of payment agreement being established
totaling over $1,000,000. We reviewed
the Federal tax filing history, as of September 17, 2002, for the 2,166
contractor employees who were issued identification badges allowing access to
the NCFB, but were not in the SETS database.
The results of our analysis are presented in Table 1.
Table 1: Contractor Employee Federal Tax Filing
History
|
Contractor Employee
Federal Tax Filing Status |
Number of
Contractor Employees |
Number of Tax
Returns |
Amount of
Revenue at Risk |
|---|---|---|---|
|
Social Security Number (SSN) did not match the IRS records |
79 |
N/A |
N/A |
|
SSN is invalid (e.g., too many digits or blank) |
182 |
N/A |
N/A |
|
Contractor employee has not filed a return, and the IRS is
inquiring about the status of the return |
134 |
178 |
N/A |
|
Contractor employee has filed a tax return but has not paid tax
due |
66 |
139 |
$688,842 |
|
Contractor employee has not filed a tax return and has a credit
balance |
44 |
N/A |
N/A |
|
Contractor employee has filed a tax return and is making
payments on an installment agreement |
36 |
N/A |
N/A |
|
Contractor employee has properly filed tax returns and paid tax
due |
1756 |
N/A |
N/A |
|
Total |
2,297 |
317 |
$688,842 |
Source: The IRS’ Master File and the Integrated Data Retrieval System
Note: The total of
contractor employees is more than 2,166 because a contractor employee’s tax
account can be in more than 1 of the filing statuses listed (i.e., different
tax years can be in a different status).
We determined that 134 contractor employees had not filed 178 tax returns, and 66 contractor employees were delinquent in paying $688,842 on 139 tax returns (see Appendix IV). Unless all contractor employee background information is sent to NBIC, the PSO cannot effectively monitor the program, assure tax-filing compliance, and protect revenue. Also, if contractor employees are not compliant with their Federal tax obligations, this could be an indication of their trustworthiness and raise concerns about whether they should be allowed to perform work for the IRS.
Contracting Officer Technical Representatives (COTR) are not requesting investigations from the NBIC as required
The Department of the Treasury COTR handbook states that the COTR is responsible for coordinating background investigations, as well as facility and system security clearances for contractor employees. However, a standard process for tracking the status of background investigations is not provided to COTRs to help them fulfill these responsibilities. As a result, COTRs have developed various methods to accept, monitor, and track the status of background investigations including spreadsheets, databases, or paper files, and there is no assurance that background investigations are being completed on all contractor employees.
To verify whether COTRs are requesting the NBIC to complete contractor employee background investigations, we judgmentally selected for review contractor employees working for contracting companies identified as Treasury Communications System (TCS) contractors or Treasury Information Processing Support Services (TIPSS) contractors. Procedures for administering the TCS and TIPSS contracts require background investigations to be completed by the NBIC. We determined that 2,235 of the 4,380 contractor employees with identification badges allowing access to the NCFB work for the TCS or TIPSS contracting companies. We compared identification badge information for these 2,235 contractor employees to the completed background investigation information at the NBIC and found 525 (23 percent) did not have background investigation information in the NBIC database. We did not determine the status of the background investigations for the remaining 2,145 contractor employees.
Not having information in the NBIC database is caused by COTRs not effectively coordinating background investigations with the NBIC. Personnel from the PSO and the REFM Office cited inadequate COTR training as a contributing cause for non-adherence to IRS procedures. To supplement the COTR handbook, personnel at the NBIC have provided informal IRS-specific training on occasion, but a formal training program focused on IRS requirements and procedures is not provided.
The Personnel Security Officer advised that IRS senior management granted a blanket authorization to 335 (all from 1 contracting company) of the 525 contractor employees, permitting them to obtain identification badges without a background investigation being initiated. These contractor employees were given access to various areas in and information of the IRS. Management advised us that they are now working to complete background investigations on the contractors that received this blanket authorization.
Providing blanket authorization to the employees of a contracting company violates Department of the Treasury policies and established IRS procedures requiring background investigations. Not adhering to established policies and inadequate training for the COTRs exposes the IRS to the potential of unauthorized use of information, theft of equipment, and physical harm to employees.
Identification badges are being issued
without required background investigation documentation
IRS
procedures provide that the REFM Office will issue identification badges to
contractor employees upon receipt of a completed badge request. This should include a memorandum from the
PSO approving the contractor employee’s access to IRS facilities based on a
completed background investigation. The
REFM personnel responsible for the
issuance of identification badges are, therefore, a control point to assure that required
approvals have been granted prior to issuance of an identification badge.
To assess the completeness of
the documentation in the identification badge files, we reviewed the 4,380
contractor employees with NCFB identification badges and identified 777
contractor employees who worked for companies for which some but not all of the
contractor employee background investigations were completed by the NBIC. The 777 contractor employees (including the
525 TIPSS and TCS contractors) did not have a record in the SETS database.
We judgmentally sampled 78
(10 percent) of these 777 contractor employees to determine if appropriate
background investigation documentation had been provided with the badge request
to the REFM personnel for the issuance of an identification badge. From our review of the documentation
maintained by the REFM Office, we found:
·
No documentation in the
files for 58 (74 percent) of the contractor employees.
·
An identification badge
request in the files for 15 (19 percent) of the contractor employees, but the
files did not include any background investigation information.
·
Complete identification
badge and background investigation information in the files for 5 (7 percent)
of the contractor employees.
REFM management stated that missing documentation was
caused by inadequate knowledge and training of personnel regarding the issuance
of identification badges.
By not obtaining the required information before issuing a contractor employee an identification badge, the IRS increases the risk of potential misuse or unauthorized disclosure of taxpayer data, loss of equipment or data through theft or sabotage, and threats to the personal safety of IRS employees.
The Chief, AWSS, in coordination with the PSO, the REFM Office, and
the Procurement Office should ensure:
2. Policies and procedures are developed to ensure that contractor employee background investigations conducted by other government agencies (e.g., GSA) are provided to NBIC.
Management’s Response: The PSO will prepare a memorandum for the Acting Commissioner’s signature re-emphasizing the policy directing IRS Business Units to ensure that background investigations are conducted on contractors who require “staff-like” access to IRS information, systems, data or facilities, including those that have background investigations completed by other government agencies.
3. A COTR training supplement is developed to emphasize the IRS-specific background investigation requirements and COTR roles, responsibilities, and procedures.
Management’s Response: The Procurement Office will coordinate with the PSO to develop an IRS-specific background investigation-training supplement. The supplement will be available to all IRS COTRs through the AWSS Procurement website. The Treasury Acquisition Institute will revise the Treasury-wide COTR training program to offer an IRS-specific component on background investigation requirements and procedures.
4. All contractor employees have properly filed their tax returns and paid their tax obligations.
Management’s Response: Increased emphasis on contractor investigation requirements via the memorandum referenced in Recommendation 2 will increase required investigations by NBIC, including tax checks.
5. Background investigations are completed on active contractor employees that obtained identification badges without a background investigation.
Management’s Response: The REFM and NBIC, in conjunction with the Business Units/COTRs, will review enterprise data to ensure that contract employees with “staff-like” access have a background check. If necessary, COTRs will initiate the appropriate investigation requests. The REFM will require a copy of the PSO’s interim or final access approval memorandum before issuing a badge to contractor employees. Management will contact COTRs to ensure contractor employees are verified every 6 months.
6. REFM personnel are adequately trained regarding the requirements for issuing a contractor employee an IRS identification badge.
Management’s Response: The field facility offices must brief new security personnel on IRM procedures. AWSS will issue a memorandum to field offices emphasizing that newly hired security personnel must be trained on current badge issuance procedures. A self-study guide will be developed for new employees.
The Office of Management and Budget (OMB) Circular A-123, Management Accountability and Control, states that proper stewardship of Federal programs and operations should ensure that government resources are used efficiently and effectively to achieve intended program results.
The SETS database is a sub-system of the personnel payroll system and is used to track the completion of background investigations, fingerprints, and security clearances. However, the SETS has constraints, including:
· Insufficient data fields to meet the needs of the IRS.
· No flexibility to change/update a data field, once the field contains data.
The Department of Agriculture has designated the SETS as a legacy application and, as such, any significant system improvements seem unlikely. Due to SETS constraints, two additional stand-alone, non-integrated databases have been created at the NBIC to supplement the SETS. Within the Personnel Services organization, employees at NBIC input contractor employee information from the background investigation requests received into three databases: the SETS database, the NBIC Background Case database, and an NBIC administrative database for monitoring the program. These stand-alone databases are used to manage the inventory of investigation requests, to monitor the status of investigations being completed, and to track the administrative data associated with the request, such as by whom the request was submitted, the contract number, etc. While some of the information in these databases is distinct, many of the fields are duplicated.
The PSO advised that it is in the process of developing and testing a new system, the Automated Background Investigation System (ABIS), which management believes will be more flexible, will eliminate the duplicate effort at the NBIC, and will increase functionality with the stakeholders needing investigation information. The ABIS, which is scheduled for implementation in February 2003, will replace the NBIC Background Case database used to track background investigations.
In addition, the Office of Technical Contract Management (TCM) provides acquisition support to approximately 60 COTRs working in the AWSS Procurement organization. During its assessment of the processes followed by COTRs, the TCM decided to standardize the COTR process for requesting and monitoring background investigations by developing a standardized database called the Procurement Background Investigation Program (PBIP). The database is to be used by the 60 COTRs in the AWSS Procurement organization; however, there is no requirement that approximately 800 COTRs in the other Headquarters and Field Business Units use the database. The TCM discussed the PBIP development with the PSO, but there was no decision to develop a combined or integrated system, although the PBIP tracks some of the same information as the SETS and ABIS.
Inadequate coordination and communication among the PSO, COTRs, and TCM have resulted in the development of multiple databases/systems without adequate consideration of system consolidation or integration. The TCM obtained contractor services for management information systems support, using two task orders for the development and maintenance of several databases, including the PBIP database. The total paid through November 1, 2002, on these task orders was $671,865. The TCM did not provide detailed information from the first task order showing the costs directly attributable to the PBIP project; however, they estimated that $301,175 of the $580,133 paid was for the creation of the PBIP database. Information provided for the second task order indicates that $37,865 of the $91,732 paid was for work on the PBIP database. In addition, the second task order has a budgeted amount totaling $491,148 to pay for additional work. Although no documentation was provided, the TCM advised us that $30,000 of this amount is estimated for further development and maintenance on the PBIP database (see Appendix IV).
In addition, the TCM stated that the PBIP database is included in the Modernization, Information Technology, and Security (MITS) Services budget; however, the 4th Quarter FY 2002 MITS Business Performance Review does not include the PBIP database as a project, indicating the project is being developed outside the MITS investment process. Therefore, there is an increased risk that the database may not integrate into future IRS modernization plans and that the data may be inconsistently entered into the different systems, requiring correction. Further, it is inefficient to enter the same data into two different systems.
A centralized complete database of all contractors and contractor background investigations does not exist. As previously mentioned, the TCM database is used by a limited number of COTRs, and the NBIC does not receive information on all contractors so that the information can be input into SETS. Not having a central repository of complete data results in the inability of the PSO to efficiently administer the personnel security program.
The Chief, AWSS, in coordination with the PSO, the REFM Office, and
the Procurement Office should ensure that:
7. A consolidated or integrated system is implemented to effectively manage all background investigations and identification badges, incorporating the needs of all stakeholders (e.g., COTR, TCM, NBIC, etc.), and eliminating the use of stand-alone systems such as the SETS and PBIP.
Management’s Response: AWSS will establish a stakeholder project team to assess background investigation program management. The team will prepare a business case analysis to focus on funding issues, improved communications with stakeholders, and information system enhancements.
8. In the interim, until a single system is implemented, all COTRs are required to use the PBIP regardless of their organizational placement, and complete periodic reconciliations between the contractor employee background investigation information and the identification badge information at each IRS facility to detect the issuance of contractor employee identification badges without completion of required background investigations.
Management’s Response: The stakeholder project team and the business case analysis prepared in response to Recommendation 7 will address this recommendation.
The GAO Standards for Internal Control in the Federal
Government require that controls be established and designed to ensure the
completeness, accuracy, authorization, and validity of all transactions during
application processing. Controls should
be installed to ensure that all inputs are received and are valid, and that
outputs are correct and properly distributed.
An example of these controls is computerized edit checks that are built
into the system to review the format, existence, and reasonableness of data.
Our analysis of the identification badge system information
for the 4,380 contractor employees with NCFB identification badges showed that
230 records (5 percent) contained data omissions or incorrect data for key pieces of information
(e.g., SSN and Contractor
Company Name). The SSN discrepancies included records with no SSN, SSNs containing all
nines or zeros, and SSNs containing too many digits.
The erroneous data in the NCFB identification badge system was caused
by not having application controls such as edit checks on the input of data.
While not having application controls was found in our review of
information from the identification badge application at the NCFB, AWSS
personnel confirmed that this identification badge system is used elsewhere and
application controls could be set similarly at other IRS field offices.
Data entry omissions, inconsistencies, and errors result in
the inability to provide complete and reliable data regarding contractor badge
information. Furthermore, these data
problems make it difficult to reconcile the identification badge database
information to other external databases, such as the SETS and the NBIC
completed investigations database.
9. The Chief, AWSS, with the assistance of the Deputy Commissioner for Modernization & Chief Information Officer, should, until the system in Recommendation 7 is implemented, improve the systems application controls to ensure that all identification badge systems contain complete and accurate contractor employee information.
Management’s Response: REFM will mandate that a standard set of data entry fields must be completed before issuing a contractor employee badge.
Appendix I
Detailed Objective,
Scope, and Methodology
The overall objective of this audit was to determine the effectiveness of the Background Investigation Program administration. To accomplish this objective, we:
I. Evaluated the Internal Revenue Service’s (IRS) policies and procedures for requesting and monitoring the status of IRS and contractor employee background investigations. In addition, we interviewed personnel responsible for the program and obtained a walk-through of the background investigation process.
II. Determined whether employee background investigations and re-investigations were completed by obtaining a download of 120,344 employee records as of January 26, 2002, from the Treasury Integrated Management Information System to identify personnel in job series that are assessed at a high- and moderate-risk level. We determined that employees in 20 job series account for approximately 94 percent of the employees in moderate- and high-risk positions at the IRS. For these job series, we obtained and reviewed the background investigation data on 43,233 employee records in the Security Entry and Tracking System (SETS) as of April 25, 2002.
III. Determined whether contractor employee background investigations and re-investigations were completed by:
A. Obtaining a download of all 13,211 contractor records in the SETS database on April 25, 2002, and comparing these records to the 4,380 contractor records obtained from the New Carrollton Federal Building identification badge system on March 7, 2002, resulting in the identification of 2,166 contractor employees who were issued badges allowing access to the IRS, but were not in the SETS. We also reviewed tax filing histories of these 2,166 contractor employees.
B. Identifying contracting companies from the Treasury Communications System and Treasury Information Processing Support Services contracts that required background investigations to be performed by NBIC resulting in the identification of 2,235 contractor employees as of April 25, 2002, and analyzing this population to determine whether background investigation information was properly recorded in the SETS. We also reviewed a judgmental sample of 78 (10 percent) of the 777 contractors that did not have information in the SETS to determine if adequate badge record documentation was retained. A judgmental sample was selected because we did not plan to project the results of our analysis.
Appendix II
Major Contributors to This Report
Scott E. Wilson, Assistant Inspector General
for Audit (Information Systems Programs)
Gary Hinkle, Acting Assistant Inspector General
for Audit (Information Systems Programs)
Danny Verneuille, Acting Director
Christopher
Funke, Senior Auditor
Linda Screws, Auditor
Appendix III
Acting Commissioner N:C
Deputy Commissioner for Modernization & Chief Information Officer M
Chief, Agency-Wide Shared Services A
Chief, Information
Technology Services M:I
Director, Personnel Services A:PS
Director, Procurement A:P
Director, Real Estate and Facilities Management A:RE
Associate Director, Personnel Security Division A:PS:PSO
Chief Counsel CC
National Taxpayer Advocate TA
Director, Legislative Affairs CL:LA
Director, Office of Program Evaluation and Risk
Analysis N:ADC:R:O
Office of Management Controls N:CFO:F:M
Audit Liaisons:
Chief, Agency-Wide Shared Services A
Program Manager, Program Oversight and Coordination M:R:PM:PO
Appendix IV
This appendix presents detailed information on the measurable impact that our recommended corrective actions will have on tax administration. These benefits will be incorporated into our Semiannual Report to the Congress.
Type and Value of Outcome Measure:
· Increased Revenue/Revenue Protection – Potential; $688,842 in delinquent contractor accounts (see page 4).
Methodology Used to Measure the Reported Benefit:
We determined that 2,166 of the 4,380 contractor employees with identification badges allowing access to the New Carrollton Federal Building (NCFB) were not in the Security Entry Tracking System (SETS). To determine the Federal tax filing history for the 2,166 contractor employees, we entered their Social Security Numbers from the identification badge system into the Integrated Data Retrieval System and extracted the tax accounts. We determined that 66 of the contractor employees were delinquent in paying $688,842 on their tax accounts. Some of these accounts with a balance due date back to 1989.
We also identified 134 contractor employees who had not filed 178 tax returns. The IRS is inquiring about the status of these returns. These accounts currently do not have a balance due, but could result in additional revenue once appropriate information is obtained.
Type and Value of Outcome Measure:
· Protection of Resources – Actual; $339,040 spent by the Office of Technical Contract Management (TCM) on the Procurement Background Investigation Program (PBIP) (see page 12).
Methodology Used to Measure the Reported Benefit:
The PBIP is being developed by the TCM to manage contractor employee background investigations while the Personnel Security Office (PSO) is in the process of developing the Automated Background Investigation System (ABIS). The PSO is responsible for the performance and management of background investigations through its National Background Investigation Center (NBIC). Since both the PBIP and ABIS are being developed to perform many of the same tasks, the contract costs expended and planned to be expended on the TCM development are unnecessary. As of November 1, 2002, estimates and detailed invoices provided by TCM indicate that $339,040 of the $671,865 paid on various projects was for the PBIP development.
Resources expended on the TCM PBIP development:
$ 37,865 detailed invoices paid for development and maintenance under the second task order.
$301,175 estimated by TCM as paid for development and maintenance under the first task order.
$339,040 Total
Type and Value of Outcome Measure:
· Cost Savings, Funds Put to Better Use – Potential; $30,000 remaining to be spent for database development and maintenance (see page 12).
Methodology Used to Measure the Reported Benefit:
The PBIP is being developed by the TCM to manage contractor employee background investigations while the PSO is in the process of developing the ABIS. The PSO is responsible for the performance and management of background investigations through its NBIC. Since both the PBIP and ABIS are being developed to perform many of the same tasks, the contract costs expended and planned to be expended on the TCM development are unnecessary. The TCM advised that $30,000 is anticipated for further development and maintenance on the PBIP database.
Type and Value of Outcome Measure:
· Taxpayer Privacy and Security – Potential; 2,166 contractors that do not have background information in the SETS (see page 4).
Methodology Used to Measure the Reported Benefit:
The IRS uses the Department of Agriculture’s SETS as its background investigation information tracking database. Through our comparison of the NCFB contractor employee identification badge information to the SETS, we determined that 2,166 contractors issued an identification badge do not have information in SETS.
Appendix V
Agency-Wide Shared Services (AWSS)
|
AWSS provides services to the Internal
Revenue Service (IRS) in the areas of procurement, diversity field services,
real estate, facilities, and personnel. |
|---|---|
Automated Background Investigation System (ABIS)
|
The ABIS is a database being developed by the Personnel Security Office to monitor and track the status of background investigations on both employees and contractor employees. |
Contracting Officer’s Technical Representative (COTR)
|
A qualified individual nominated by the requiring organization and designated by the Contracting Officer to monitor, evaluate, and accept contract services. |
Contractor Employee
|
Refers to all non-federal employees working on an IRS contract,
including all subcontractors requiring access to the facilities or
information of the IRS. |
Integrated Data Retrieval System (IDRS)
|
IRS computer system capable of retrieving or updating stored information; it works in conjunction with a taxpayer’s account records. |
Master File
|
The IRS’ database that stores various types of taxpayer account information. This database includes individual, business, and employee plans and exempt organizations data. |
National Background Investigations Center (NBIC)
|
NBIC completes background investigations for the IRS. NBIC is under the direction of the Personnel Security Officer in AWSS. |
Personnel Security Office (PSO)
|
The PSO is a division of the Personnel Services organization under AWSS. This office oversees the completion and adjudication of background investigations on employees and contractor employees. |
Procurement Background Investigation Program (PBIP)
|
The PBIP is a database developed by the Office of Technical Contract Management to track information being sent and received by COTRs during the background investigation process, including the cost of the investigation request and the contract to which the investigation was requested. |
Appendix VI
Management’s Response
to the Draft Report
The response
was removed due to its size. To see the
complete response, please go to the Adobe PDF version of the report on the
TIGTA Public Web Page.