TREASURY INSPECTOR GENERAL FOR TAX ADMINISTRATION

 

 

Accountability Over Volunteer Income Tax Assistance Program Computers Continues to Be a Problem

 

 

 

September 25, 2006

 

Reference Number:  2006-40-172

 

 

This report has cleared the Treasury Inspector General for Tax Administration disclosure review process and information determined to be restricted from public release has been redacted from this document.

 

Phone Number   |  202-927-7037

Email Address   |  Bonnie.Heald@tigta.treas.gov

Web Site           |  http://www.tigta.gov

 

September 25, 2006

 

 

MEMORANDUM FOR CHIEF INFORMATION OFFICER
COMMISSIONER, WAGE AND INVESTMENT DIVISION

 

FROM:                            Michael R. Phillips /s/ Michael R. Phillips

                                         Deputy Inspector General for Audit

 

SUBJECT:                    Final Audit Report – Accountability Over Volunteer Income Tax Assistance Program Computers Continues to Be a Problem (Audit #200640030)

 

This report presents the results of our review to assess whether computers used in the Volunteer Income Tax Assistance (VITA) Program[1] are properly accounted for and controlled.  In an effort to promote electronic filing (e‑filing), the Internal Revenue Service (IRS) provides computers[2] to enable VITA Program sites to offer taxpayers the option of e‑filing their tax returns.  These computers are loaded with the tax preparation software necessary to e-file a tax return with the IRS.  During Fiscal Year 2006, VITA Program sites were involved in the preparation of over 2 million tax returns, with about 1.9 million being e-filed.

Impact on the Taxpayer

In a prior Treasury Inspector General for Tax Administration report dated August 2002,[3] we identified concerns that the IRS did not have adequate internal controls and accountability over the computers it provides to volunteers.  We again identified that key controls designed by the IRS to assist in accounting for computers are not being consistently followed.  Taxpayer data are at risk of unauthorized disclosure or misuse as a result of the IRS’ inability to accurately account for VITA Program computers used in the preparation and transmission of electronic tax returns.

 

Synopsis

Taxpayer data are at risk of unauthorized disclosure or misuse as a result of the IRS’ inability to accurately account for VITA Program computers.

In our prior report, we stated the IRS could not physically account for computers provided to VITA Program volunteers.  This happened because the IRS did not consistently conduct the required annual certification of the Information Technology and Asset Management System (ITAMS),[4] immediately record receipt of new computers on the ITAMS, and update inventory records when equipment was delivered.  Again, key controls designed by the IRS to assist in accounting for computers are not being consistently followed.  During this review, much of the information provided to support the accounting for VITA Program computers was inconsistent and changed throughout the course of the audit.  The issues detailed below are similar to those identified and reported in our prior review. 

·         The IRS accounted for 97 percent (191 of 197) of the computers sampled; however, repeated attempts were necessary to locate the computers. 

·         During the period October 2003 to February 2006, Modernization and Information Technology Services organization employees changed the ITAMS name data field for 7,150 computers[5] to reflect these computers as being in the VITA Program.  IRS management stated the ITAMS name data field was changed in an attempt to clean up inventory.

·         The IRS did not ensure required procedures were followed when disposing of computers on the ITAMS.  The Reports of Survey (Form 1933)[6] used to document the disposal of assets did not contain proper authorizations, details of the specific actions taken to locate the computers prior to removing them as lost, or the required statement on whether taxpayer data were at risk.

Documentation was not provided to support inclusion of VITA Program computers in the IRS’ annual certifications.  These computers were also not included in the Government Accountability Office’s annual audit of the IRS’ financial statements.

We will be referring information relative to the above ITAMS transactions to our Office of Investigations.  Additionally, the IRS was unable to provide documentation to demonstrate that the VITA Program computers have been consistently included in the IRS’ annual certification of its computer inventory.  IRS management initially stated the VITA Program computers were not included in the required annual certifications.  After we completed audit testing and discussed the results with IRS officials, Modernization and Information Technology Services organization management provided a memorandum indicating the computers located at the Computer Depot[7] were included in the Fiscal Year 2004 Annual Certification.  They believe a certification of the Computer Depot inventory was completed again in Fiscal Year 2005 but could not provide the required memorandum supporting their claim.  The VITA Program computers were also not included in the Government Accountability Office Fiscal Years 2003 through 2005 annual audits of the IRS’ financial statements.

The IRS stated it plans to take actions to address concerns raised during our review.  These include certifying the VITA Program computer inventory beginning in Fiscal Year 2006, developing guidelines outlining responsibilities of the Stakeholder Partnerships, Education, and Communication (SPEC) and the End User Equipment and Services functions, and monitoring and limiting the ability to change the ITAMS name data field.

Recommendations

The Chief Information Officer and the Commissioner, Wage and Investment Division, should (1) perform a physical inventory and reconciliation of computers listed on the SPEC Taxpayer Assistance Reporting System (STARS)[8] to computers listed on the ITAMS and ensure VITA Program computers are included in the required annual certification of the ITAMS, (2) integrate the ITAMS and STARS to link the information between the two and ensure all VITA Program computers are properly and efficiently controlled, (3) develop guidelines outlining the responsibilities of the SPEC and End User Equipment and Services functions pertaining to the control and accountability of VITA Program computers, and (4) ensure proper authorization and physical verification of computers are obtained prior to reassigning computers on the ITAMS and ensure required procedures are followed when disposing of computers.

Response

The IRS agreed with our recommendations and has taken or will take the following actions: 

  • The SPEC function will perform a physical inventory and reconciliation of computers on the STARS.  The End User Equipment and Services function will ensure VITA Program computers are included in the required annual certification of the ITAMS. 
  • The IRS will modify the ITAMS and STARS to enable linking with each other, to improve the control over computers used in the VITA Program.
  • On May 19, 2006, the End User Equipment and Services and SPEC functions signed a Memorandum of Understanding outlining the roles and responsibilities for the SPEC function, the Computer Depot, and the loan of equipment to VITA Program partners.
  • The IRS will reinforce guidelines already in place with its employees responsible for inventory to ensure they follow the required procedures for reassigning or disposing of VITA Program computers. 

Management’s complete response to the draft report is included as Appendix V.

Copies of this report are also being sent to the IRS managers affected by the report recommendations.  Please contact me at (202) 622-6510 if you have questions or Michael E. McKenney, Assistant Inspector General for Audit (Wage and Investment Income Programs), at (202) 622-5916. 

 

 

Table of Contents

 

Background

Results of Review

Procedures Are Not Adequate to Ensure Volunteer Income Tax Assistance Program Computers Are Properly Controlled

Recommendations 1 through 4:

Appendices

Appendix I – Detailed Objective, Scope, and Methodology

Appendix II – Major Contributors to This Report

Appendix III – Report Distribution List

Appendix IV – Report of Survey

Appendix V – Management’s Response to the Draft Report

 

 

Abbreviations

 

AWSS

Agency-Wide Shared Services

e‑filing

Electronic Filing

EUES

End User Equipment and Services 

GAO

Government Accountability Office 

IRS

Internal Revenue Service

ITAMS

Information Technology and Asset Management System

MITS

Modernization and Information Technology Services

SPEC

Stakeholder Partnerships, Education, and Communication

STARS

SPEC Taxpayer Assistance Reporting System

TIGTA

Treasury Inspector General for Tax Administration

VITA

Volunteer Income Tax Assistance

 

 

Background

 

The Internal Revenue Service (IRS) Volunteer Income Tax Assistance (VITA) Program[9] provides free tax help to people for whom professional assistance may be too expensive.  The IRS partners with the military, community-based organizations, and the AARP[10] to assist individuals with the preparation of basic income tax returns.[11]  Particularly, it assists those who have low incomes or disabilities or are non‑English speaking, elderly, or have other special needs.  Oversight of the VITA Program is the responsibility of the Stakeholder Partnerships, Education, and Communication (SPEC) function, located in the IRS Wage and Investment Division.

In an effort to promote electronic filing (e‑filing), the IRS provides computers[12] to enable VITA Program sites to offer taxpayers the option of e‑filing their tax returns.  These computers are loaded with the tax preparation software necessary to e‑file a tax return with the IRS.  During Fiscal Year 2006, VITA Program sites were involved in the preparation of over 2 million tax returns, with about 1.9 million being e-filed.

A prior TIGTA review identified the IRS does not have adequate internal controls and accountability over VITA Program computers.

In a prior Treasury Inspector General for Tax Administration (TIGTA) report dated August 2002,[13] we identified concerns that the IRS did not have adequate internal controls and accountability over the computers it provides to volunteers.  The IRS could not physically account for computers provided to VITA Program volunteers.  This happened because the IRS did not consistently perform the required annual certification of the Information Technology and Asset Management System (ITAMS),[14] immediately record receipt of new computers on the ITAMS, and update inventory records when equipment was delivered.  In addition, several factors contributed to the inadequate internal controls and accountability over computer equipment.  These factors included a lack of SPEC function management oversight and no physical verification and/or reconciliation to determine the volume and location of computers transferred when the SPEC function was established.  We recommended the IRS perform a physical inventory of all computers included in the VITA Program, develop procedures to ensure computer equipment obtained from external agencies is immediately added to the inventory records, and develop procedures to ensure taxpayer e-file data are removed from volunteer computers. 

Management agreed with our recommendations.  The IRS stated that it instructed field employees to complete an inventory assessment and validate equipment used in the VITA Program and to suspend the acquisition of equipment from external sources.  Management also stated that they have instructed Territory offices[15] to delete taxpayer data from VITA Program computers.  The IRS advised us that additional processes have been put in place to protect taxpayer data, such as adding password protection at the operating system level and using a “disk wipe” program that deletes all programs, including taxpayer data, from the hard drive.  The IRS stated that it has also created a property loan agreement to specifically address how the equipment can or cannot be used and is addressing the addition of software to the equipment.  Finally, the IRS stated that it developed a database to accurately account for the location of the computer inventory to supplement the existing database, ITAMS, which could not accommodate all the inventory needs for this Program.  

Accountability for VITA Program computers is a responsibility shared between the SPEC function and the End User Equipment and Services (EUES) function, located in the IRS Modernization and Information Technology Services (MITS) organization.  The MITS organization is responsible for the accounting and recording of all computers and technology equipment.  The SPEC function is responsible for assigning and determining the placement of the computers with volunteers and its partners, maintaining the related documentation on the assignments, and controlling the computers and assignments on the SPEC Taxpayer Assistance Reporting System (STARS).

The EUES function provides technical support for VITA Program computers at its Computer Depot.  Established in August 2003, the Computer Depot is a centralized location that receives computers for the VITA Program, prepares them for use by loading the operating system and tax preparation software, ships them to volunteers, and stores them when they are not in use (e.g., not assigned to volunteers).  In addition, the EUES function maintains computer inventory records on the ITAMS.  The ITAMS was developed in March 2001 and is used to control all IRS computer assets, including VITA Program computers.  The ITAMS is the IRS’ authoritative record for asset control, where each piece of equipment is tracked from procurement to disposal.  As of February 2006, there were approximately 15,000 computers in active VITA Program inventory, with approximately 11,000 computers assigned to volunteers and 4,000 in storage at the Computer Depot.

This review was performed at the MITS organization’s offices in New Carrollton, Maryland; the Wage and Investment Division SPEC function Headquarters office in Atlanta, Georgia; and the EUES function Computer Depot located at the Brookhaven Campus[16] in Holtsville, New York, during the period December 2005 through July 2006.  During this review, much of the information provided to us to support the accounting for VITA Program computers was inconsistent and changed throughout the course of the audit.  These matters are discussed in further detail in the Results of Review section of the report.  The audit was conducted in accordance with Government Auditing Standards.  Detailed information on our audit objective, scope, and methodology is presented in Appendix I.  Major contributors to the report are listed in Appendix II.

 

 

Results of Review

 

Procedures Are Not Adequate to Ensure Volunteer Income Tax Assistance Program Computers Are Properly Controlled

Taxpayer data are at risk from unauthorized disclosure or misuse as a result of the inability to accurately account for VITA Program computers used in the preparation and transmission of electronic tax returns.  The issues detailed below are similar to those identified and reported in our prior review.  These issues include:

·         Although the IRS was able to account for 191 (97 percent) of 197 of the computers sampled,[17] repeated attempts were necessary to locate some computers.  It took between 2 months and 3 months to locate 52 computers and up to 5 months to locate 9 computers.  Three of the six computers not located were assigned to volunteers; the remaining three were listed with incorrect information on the STARS and ITAMS or as unassigned and in inventory at the Computer Depot.  Repeated attempts were necessary to find some of the computers tested because the IRS maintains two separate inventory systems (the STARS and the ITAMS) and their inventory records did not agree.  There are no specific guidelines outlining the responsibilities of the SPEC and EUES functions regarding the accountability of VITA Program computers.

·         During the period October 2003 to February 2006, MITS organization employees changed the ITAMS name data field for 7,150 computers[18] to reflect these computers as being in the VITA Program.  IRS management stated that the ITAMS name data field was changed in an attempt to clean up inventory.

·         The IRS did not ensure required procedures were followed when disposing of computers.  The Reports of Survey (Form 1933)[19] used to document the disposal of assets did not contain proper authorizations, details of the specific actions taken to locate the computers prior to removing them as lost, or the required statement on whether taxpayer data were at risk.

We will be referring information relative to the above ITAMS transactions to our Office of Investigations.  The IRS was also unable to provide documentation to demonstrate that the VITA Program computers have been consistently included in IRS’ annual certification of its computer inventory.  In addition, VITA Program computers were not included in the Government Accountability Office (GAO) Fiscal Years 2003 through 2005 annual audits of the IRS’ financial statements.

The majority of the control breakdowns occurred in the MITS organization.  The IRS stated it plans to take actions to address concerns raised during our review, including certifying the VITA Program computer inventory in Fiscal Year 2006, developing guidelines outlining responsibilities of the SPEC and EUES functions, and monitoring and limiting the ability to change the ITAMS name data field.

Two separate inventory systems are used to account for VITA Program computers

The IRS maintains two inventory systems to account for VITA Program computers because the ITAMS structure is limited and cannot capture VITA Program partner, site, or volunteer specific information.  This information is captured on the STARS, and the SPEC function needs this information to appropriately account for VITA Program computers. 

In an effort to ensure the STARS and ITAMS agree, the IRS uses a two-way matching process.  Update extracts are generated from the STARS when inventory records are changed.  These update extracts are provided to the MITS organization to be used to update the ITAMS.  Similarly, when inventory records on the ITAMS are changed, ITAMS updates are provided to the SPEC function to be used to update the STARS.

The two-way matching process was not used to ensure the STARS and ITAMS computer inventories were in agreement.

However, the MITS organization was not using the information extracted from the STARS to update the ITAMS because the information was considered unreliable.  In addition, the ITAMS update extracts were incomplete and the information was not current, creating update delays to the STARS of up to 6 weeks.  As a result, inventory records reflected in the STARS and ITAMS were not in agreement.

We selected a judgmental sample of 50 computers physically located at the Computer Depot to assess the accuracy of the STARS and ITAMS for these computers. 

·         For 8 (16 percent) of the 50 computers, the STARS did not show them correctly as being located at the Computer Depot. 

·         For 3 (6 percent) of the 50 computers, the ITAMS did not show them correctly as being located at the Computer Depot. 

Based on the results of our sample, we matched extracts from the STARS to the ITAMS.  There were a total of 16,559 unique VITA Program computers listed on these inventory systems.  The ITAMS extract dated December 12, 2005, showed 15,690 VITA Program computers while the STARS extract dated December 9, 2005, showed 14,531 computers assigned to the VITA Program.  There were 13,662 computers on both inventory systems.  However, 2,028 computers were on the ITAMS and not on the STARS, and 869 computers were on the STARS and not on the ITAMS.

Although there are two systems controlling the VITA Program computers, there is no clear separation of responsibilities and duties to ensure the computers are properly accounted for.  For example, the Computer Depot has taken responsibility for updating both the STARS and the ITAMS for computers used by AARP volunteers.  The computers loaned to the AARP account for approximately two‑thirds of the computers used by volunteers.  The updating of both the STARS and ITAMS by one function raises concerns because there is not a clear separation of duties when the Computer Depot both receives and disposes of computers as well as records these transactions.

Key duties and responsibilities should be divided or segregated to reduce the risk of error or fraud.  This should include separation of responsibility for authorizing transactions; processing, recording, and reviewing the transactions; and handling any related assets.

Ineffective internal controls allowed computers to be reassigned on the ITAMS without proper authorization or validation

We reported concerns in August 2002 that VITA Program computers could not be located and taxpayer data may be at risk.  This review identified the same problems.  Key controls designed by the IRS to assist in controlling VITA Program computers and protecting taxpayer information are not consistently followed.  Documentation was not provided to support the consistent inclusion of VITA Program computers in the annual certifications of the IRS’ computer inventory, and MITS organization employees were able to change ITAMS records without proper authorization or validation.

In August 2002, we also reported the SPEC function could not provide documentation that VITA Program computers were included in the Fiscal Year 2001 Annual Certification.  The IRS was again unable to provide documentation to demonstrate that the VITA Program computers have been consistently included in IRS’s annual certification of its computer inventory.  Specifically, IRS management initially stated the VITA Program computers were not included in the required annual certification that (1) verifies the existence of the assets, (2) verifies all assets have an associated inventory record on the ITAMS, (3) certifies the correctness of data contained in the critical fields on the ITAMS,[20] (4) corrects data inaccuracies in the ITAMS critical to control of assets, and (5) ensures all asset inventory transactions are updated in the ITAMS.  Verifying the physical existence of the computer is of utmost importance.  IRS guidelines also require that a certification letter be prepared to include a statement of certification, completeness, and accuracy. 

However, after we completed audit testing and discussed the results with IRS officials, they provided a memorandum indicating the VITA Program computers located at the Computer Depot (where the majority of VITA Program computers are located) were included in the Fiscal Year 2004 Annual Certification.  MITS organization management believes a certification of the Computer Depot inventory was also completed in Fiscal Year 2005, but they could not provide a copy of the required certification memorandum.

Furthermore, during the period October 2003 to February 2006, MITS organization employees changed the ITAMS name data field for 7,150 computers to show them as assigned to the VITA Program.  IRS management stated these records were changed to clean up the inventory of computers that were old, were obsolete, or could not be located.  Although the ITAMS name data field was changed, the physical location field was not changed for 5,157 (72 percent) of the 7,150 computers, confirming these computers had not been physically transferred to the Computer Depot.  The disposition of these 7,150 computers as recorded on the ITAMS is shown in Figure 1.

Figure 1:  Disposition of 7,150 Computers

Figure 1 was removed due to its size.  To see Figure 1, please go to the Adobe PDF version of the report on the TIGTA Public Web Page.

We have concerns with the changes to the system name data field because the changes reflect transfers that may not have occurred.  The ability of IRS employees to circumvent internal controls by changing ITAMS records raises serious concerns about the validity of the transactions in the ITAMS and the physical accounting for these computers.  It is a strong indication that the internal control environment is ineffective. 

Changing the name data field in the ITAMS to show these were VITA Program computers also resulted in computers being excluded from the extract of IRS computers provided to the GAO to select its sample of computers to perform the yearly verification for its financial audit.  The IRS and GAO agreed not to include the VITA Program computers in the GAO Fiscal Year 2003 through 2005 annual audits of the IRS’ financial statements.  According to the IRS, it has achieved an accuracy rate of over 95 percent in each of the past 3 years, enabling it to pass the last GAO financial audit.  This high accuracy rate may have resulted from not including VITA Program computers in the GAO’s statistical sample for its financial audit.[21] 

Transactions such as those to record the transfer and disposition of assets as well as other significant events should be authorized and executed only by persons acting within the scope of their authority.  This is the principal means of assuring that only valid transactions to exchange, transfer, use, or commit resources and other events are initiated or entered in to.  In addition, documentation should be readily available for examination, and all documentation and records should be properly managed and maintained.

Required procedures were not followed when disposing of computers

A total of 1,041 computers were disposed of without following proper procedures.

A test of 1,041 of the 1,118 ITAMS inventory records with a disposition type of lost inventory with no criminal activity showed MITS organization employees did not properly follow procedures when disposing of these computers.  As a result, there is no assurance that proper actions were taken to locate the computers and assess the risk the lost computers may have on taxpayer data. 

The IRS uses Form 1933 to guide employees when they are trying to locate computers and protect taxpayer information.  This process requires users to document on the Form 1933:

(1)   Results of a physical search for the computer based on location and contact information reflected in the ITAMS.

(2)   Results of a telephone contact with the last person responsible for possession of the computer.

(3)   Results of an email contact with the responsible person.

(4)   Results of a contact with the manager of the responsible person.

(5)   An explanation of whether taxpayer data were at risk.

Thirty-three (3 percent) of the 1,041 ITAMS inventory records were not listed on a Form 1933.  The remaining 1,008 ITAMS inventory records were listed on 52 Forms 1933.  However, 31 (60 percent) of the 52 Forms 1933 did not contain the required authorization from the Agency-Wide Shared Services (AWSS) organization approving official.  The final disposition of computers is processed through the ITAMS and authorized by an AWSS organization approving official.  This process is in place to ensure duties are separated. 

Although justifications for writing off the computers were included on 50 (96 percent) of the 52 Forms 1933, none of the justifications detailed the actions taken to try to locate the computers prior to writing them off as lost, as required.  In addition, we question the validity of the justifications that detail computers as being part of the VITA Program because the physical location field was not changed for 5,157 of the 7,150 (72 percent) computers, confirming these computers had not been physically transferred to the VITA Program. 

Examples of justifications included: 

        The equipment listed was not located in the last inventory and is presumed to have been previously excessed, lost or to never have been received.  . . .  To the best of our knowledge there is no taxpayer data at risk.

        Equipment has not been located, validated, or inventoried for the past two (2) certification periods.

        These desktops were assigned to the . . . SPEC Office for VITA.  These desktops were given to VITA partners including AARP and NAVY.  These desktops will not be returned to the IRS, and therefore are being surveyed out from ITAMS. 

        This MITS Equipment was assigned to the . . . MITS office.  During the FY [Fiscal Year] 2005 inventory these items could not be located.  After extensive searches by employees of both MITS these items can not be located.  The equipment on this Report of Survey is for the following reason:

1.   The asset may have been disposed of on a previous report of survey, but was not removed from the data base.

2.   The asset may have been parted out and never recorded on a previous report.

3.   The asset may have failed and been replace[sic] without appropriate record keeping.

4.   The asset may have been improperly disposed of with no record kept.

In addition, the required explanation of whether taxpayer data were at risk was not included on 49 (94 percent) of the 52 Forms 1933 provided.  For the remaining three Forms 1933, the following statement was made:  To the best of our knowledge, there is no taxpayer data at risk.”

Furthermore, Forms 1933 included in our sample raise additional concerns as to the validity of the actions and information provided to support the removal of computers from the ITAMS inventory.  For example:

·         One Form 1933 was dated April 2006, 1 month later than the ITAMS extract of disposed assets generated in March 2006.  This particular Form 1933 listed 43 computers from our sample.  However, these 43 computers were shown in the ITAMS as retired from inventory records in June 2005.  Subsequent to our bringing this to MITS organization management’s attention, a Form 1933 dated February 2006 was provided for these same computers.

·         One Form 1933 was provided May 2006 for six computers.  Subsequently, another Form 1933 dated July 2006 was provided for these same computers.  Although the computers listed on the Forms matched, there were different approving officials on each Form 1933.

After we presented the audit results to IRS management, additional information was provided to support the disposal of the 1,041 computers.  However, 1 Form 1933, which included 276 computers, contained information that conflicted with that we had been advised of earlier.  We had been advised that the 276 computers included in our sample and listed on the Forms 1933 had been disposed of because they were lost.  This additional Form 1933 stated VITA Program computers were donated.  Further, an IRS representative stated:

This equipment was assigned to . . . SPEC for the . . . (VITA) project.  As the equipment was somewhat old and obsolete, once it was issued to the VITA partners, it was determined that the equipment would not be returned into the IRS offices for excess.  When equipment was issued from MITS, there was no taxpayer data on the CPUs [central processing units], only the operating system and any . . . software loaded by either MITS or SPEC.  Once it was determined that the equipment would not be returned to the IRS, the Form 1933 was prepared by MITS to show that the equipment had been “donated” to the VITA Project, and a copy of the Form 1933 would have been turned over to AWSS.  TIGTA would not have been involved in this, as the equipment was not missing but rather donated.

When we questioned whether the computers were in fact donated, we were informed older computers used by the IRS that were ready for disposal were turned over to the VITA Program and given to its VITA Program partners.  The IRS could not provide documentation to support this claim.  If these computers were in fact donated, this may be in violation of the Federal Property and Administrative Services Act of 1949,[22] which prohibits the donating of computers to volunteers.

During the course of this review, we made repeated attempts to obtain documentation to support actions taken to dispose of computers.  Although some documentation was ultimately provided, it was inadequate and we were unable to substantiate the reliability of this information.  There is no assurance that taxpayer data are not at risk if these computers were in IRS operations or in the VITA Program.  No documentation was provided to support the removal of taxpayer information from the computers.  Information on tax forms, including names, Social Security Numbers, income, employment and bank account details, is regarded as a prime target for identity thieves. 

Recommendations

The Chief Information Officer and the Commissioner, Wage and Investment Division, should:

Recommendation 1:  Perform a physical inventory and reconciliation of computers listed on the STARS to computers listed on the ITAMS to ensure all computers are accounted for and the systems’ records are accurate.  Additionally, ensure VITA Program computers are included in the required annual certification of the ITAMS.

Management’s Response:  The IRS agreed with this recommendation.  The SPEC function will perform a physical inventory and reconciliation of computers on the STARS.  The EUES function will ensure VITA Program computers are included in the required annual certification of the ITAMS.  In accordance with the annual certification plan, the Computer Depot will conduct a final verification of assets and certify the accuracy of the inventory records and reconciliation as directed by the Asset Management Program Office. 

Recommendation 2:  Integrate the ITAMS and STARS to link the information between the two and ensure all VITA Program computers are properly and efficiently controlled.

Management’s Response:  The IRS agreed with this recommendation and will modify the ITAMS and STARS to enable linking with each other, to improve the control over computers used in the VITA Program. 

Recommendation 3:  Develop guidelines outlining the responsibilities of the EUES and SPEC functions pertaining to the control and accountability of VITA Program computers.

Management’s Response:  The IRS agreed with this recommendation.  On May 19, 2006, the EUES and SPEC functions signed a Memorandum of Understanding outlining the roles and responsibilities for the SPEC function, the Computer Depot, and the loan of equipment to VITA Program partners.

Recommendation 4:  Ensure proper authorization and physical verification are obtained prior to reassigning computers on the ITAMS to VITA Program inventory records and ensure required procedures are followed when disposing of computers within the ITAMS inventory records.

Management’s Response:  The IRS agreed with this recommendation and will reinforce guidelines already in place with its employees responsible for inventory to ensure they follow the required procedures for reassigning or disposing of VITA Program computers.  Accountability and review of effectiveness will be ensured through Quality Assurance reviews.

 

Appendix I

 

Detailed Objective, Scope, and Methodology

 

The overall objective of this review was to assess whether computers used in the VITA Program are properly accounted for and controlled.  To accomplish this objective, we:

I.                   Determined whether the SPEC function properly controls and accounts for VITA Program computers. 

A.    Interviewed SPEC function management to determine current and planned inventory control procedures.

B.     Obtained and reviewed SPEC function guidelines to determine whether the procedures for controlling and accounting for VITA Program computers were adequate.

C.     Using a statistically valid sample, determined whether the computers assigned to the Territory offices[23] were accurately controlled and accounted for on the STARS and ITAMS.  A statistically valid sample of 138 computers was selected during fieldwork to enable a projection to the entire population.  The sample included computers that were in stock at the Computer Depot, in stock in a SPEC Territory office, and in use in a VITA Program site.  The sample of 138 computers was selected from a STARS extract dated January 25, 2006, with a population of 16,053 computers.  The sample size was based on an error rate of 10 percent, a confidence level of 1.96, and a precision rate of +5 percent.[24]

1.      For computers listed as “in use,” determined who the computers were assigned to, contacted the individuals to determine whether they had the computer, and, if so, obtained the barcode and serial number of the computer in their possession.  We matched this information to our sample of inventory records to confirm the accuracy. 

2.      For computers listed as “in stock,” we sent an email to the specific Territory offices where the computers were assigned.  We requested an email response detailing the barcodes and serial numbers of all computers, confirmed the information, and matched the remaining computers to inventory records to assess the accuracy. 

D.    Determined the effect on both the IRS and taxpayers.

II.                Determined whether the Computer Depot properly controls and accounts for VITA Program computers. 

A.    Interviewed EUES function management to determine current and planned inventory control procedures.

B.     Obtained and reviewed the Computer Depot’s guidelines to determine whether procedures for controlling and accounting for VITA computers were adequate. 

C.     Selected a judgmental sample of 109 computers actually located at the Computer Depot and determined whether the computers were correctly controlled on the ITAMS and the STARS.  We selected a judgmental sample of 59 VITA Program computers from the STARS by using a random number of 55 from a population of computers that were in stock at the Computer Depot and had barcodes with the last two digits of 55.  We placed the barcodes in ascending order and then selected every other computer beginning with the first computer.  Additionally, we judgmentally selected 50 computers that were on hand at the Computer Depot.  We used a judgmental sample to determine whether further testing would be necessary. 

D.    Using the statistically valid sample in Step I. C., determined whether the computers assigned to the Computer Depot were controlled and accounted for. 

1.      For computers listed as “in use,” reviewed SPEC function information to determine who was assigned the computer, contacted these individuals to determine whether they had a computer, and obtained the barcode and serial number for the computer in their possession.  We matched this information to inventory records to confirm the accuracy.

2.      For computers listed as “in stock,” visited the Computer Depot, physically confirmed possession of the computers, and, based on the results, confirmed the accuracy of the inventory records. 

E.     Determined the effect on both the IRS and taxpayers.

III.             Assessed the accuracy and reliability of data in the STARS and the ITAMS.

A.    Requested an extract from the STARS and the ITAMS detailing computers in the possession of the VITA Program. 

B.     Analyzed the data included in the two inventory systems to identify anomalies and determined whether similar data included in the two inventory systems were consistent, accurate, and complete.  Based on analysis of the data in the two inventory systems, we determined the inventory records in both systems were not in agreement.

IV.             Assessed whether procedures were followed when disposing of VITA Program assets.

A.    Using a judgmental sample, determined whether MITS organization employees followed procedures when disposing of VITA Program computers.  During fieldwork, we selected a judgmental sample of 1,041 computers that were recorded as disposed of and considered lost.  The sample was selected from a population of 7,150 computers recorded on the ITAMS.  We used a judgmental sample because we wanted to test whether the Territory offices with the highest number of computers disposed of had followed procedures.

B.     We determined the effect on both the IRS and taxpayers.

 

Appendix II

 

Major Contributors to This Report

 

Michael E. McKenney, Assistant Inspector General for Audit (Wage and Investment Income Programs)

Augusta R. Cook, Director

Russell P. Martin, Manager

Lena Dietles, Lead Auditor

Pamela DeSimone, Senior Auditor

Jean Bell, Auditor

Roberta Fuller, Auditor

 

Appendix III

 

Report Distribution List

 

Commissioner  C

Office of the Commissioner – Attn:  Chief of Staff  C

Deputy Commissioner for Operations Support  OS

Deputy Commissioner for Services and Enforcement  SE

Chief, Agency-Wide Shared Services  OS:A

Deputy Commissioner, Wage and Investment Division  SE:W

Director, Customer Assistance, Relationships, and Education, Wage and Investment Division  SE:W:CAR

Associate Chief Information Officer, End User Equipment and Services  OS:CIO:EU

Director, Strategy and Finance, Wage and Investment Division  SE:W:S

Chief, Performance Improvement, Wage and Investment Division  SE:W:S:PI

Director, Stakeholder Partnerships, Education, and Communication, Wage and Investment Division  SE:W:CAR:SPEC

Chief Counsel  CC

National Taxpayer Advocate  TA

Director, Office of Legislative Affairs  CL:LA

Director, Office of Program Evaluation and Risk Analysis  RAS:O

Office of Internal Control  OS:CFO:CPIC:IC

Audit Liaison:  Senior Operations Advisor, Wage and Investment Division  SE:W:S

 

Appendix IV

 

Report of Survey

 

The form was removed due to its size.  To see the form, please go to the Adobe PDF version of the report on the TIGTA Public Web Page.

 

Appendix V

 

Management’s Response to the Draft Report

 

The response was removed due to its size.  To see the response, please go to the Adobe PDF version of the report on the TIGTA Public Web Page.



[1] For the purposes of this report, the VITA Program includes the Tax Counseling for the Elderly Program.

[2] An extract dated February 2006 identified approximately 11,000 computers were assigned to volunteers.

[3] Computers Used to Provide Free Tax Help and That Contain Taxpayer Information Cannot Be Accounted For (Reference Number 2002-40-144, dated August 2002).

[4] The ITAMS is the IRS’ authoritative record for asset control, where each piece of equipment is tracked from procurement to disposal.

[5] Computers were listed on the ITAMS under the category of retired asset and were not reflected in active VITA Program computer inventory totals.

[6] See Appendix IV.

[7] The Computer Depot is a centralized location that receives computers for the VITA Program, prepares them for use by loading the operating system and tax preparation software, ships them to volunteers, and stores them when they are not in use.

[8] The STARS is a database that resides in a network environment used to record VITA Program partner information.

[9] For the purposes of this report, the VITA Program includes the Tax Counseling for the Elderly Program.

[10] The AARP was formerly known as the American Association of Retired Persons. 

[11] Basic income tax returns include the U.S. Individual Income Tax Return (Forms 1040 and 1040A) and the Income Tax Return for Single and Joint Filers With No Dependents (Form 1040EZ).

[12] An extract dated February 2006 identified approximately 11,000 computers were assigned to volunteers.

[13] Computers Used to Provide Free Tax Help and That Contain Taxpayer Information Cannot Be Accounted For (Reference Number 2002-40-144, dated August 2002).

[14] The ITAMS system is the IRS’ authoritative record for asset control, where each piece of equipment is tracked from procurement to disposal.

[15] Territory offices are SPEC function field offices.

[16] The campuses are the data processing arm of the IRS.  They process paper and electronic submissions, correct errors, and forward data to the Computing Centers for analysis and posting to taxpayer accounts.

[17] The total of 197 computers represents both a judgmental sample (59) and statistical sample (138) selected to determine if the computers could be physically located. 

[18] These computers were listed on the ITAMS under the category of retired asset and are not reflected in active VITA Program computer inventory totals. 

[19] See Appendix IV.

[20] Critical fields include assignment, barcode, building location, and user name.

[21] The IRS stated it had an agreement with the GAO to exclude VITA Program computers from the GAO’s annual financial audit. 

[22] Pub. L. No. 81-152, 63 Stat. 377 (codified as amended in scattered sections of 40 U.S.C and 41 U.S.C.).

[23] Territory offices are SPEC function field offices.

[24] We did not project to the total population the number of computers that were not accounted for because the accountability rate fell within the margin of error of +5 percent.