TREASURY INSPECTOR GENERAL FOR TAX ADMINISTRATION

Office of Audit

WEAKNESSES IN BUSINESS RESUMPTION PLANS COULD DELAY RECOVERY FROM A DISASTER

Issued on September 17, 2008

Highlights

Highlights of Report Number:  2008-20-178 to the Internal Revenue Service Chief, Agency-Wide Shared Services.

IMPACT ON TAXPAYERS

Business resumption plans are designed to help the IRS recover, restore, and resume normal business operations after a disaster or an emergency.  However, the IRS business resumption plans TIGTA reviewed were not adequately completed and would not facilitate the efficient recovery of critical processes.  An extended disruption could affect key processes such as collecting taxes, processing tax returns and refunds, and responding to taxpayer inquiries.  Processing delays could ultimately have a negative impact on the nation’s economy and future taxpayer compliance.

WHY TIGTA DID THE AUDIT

This audit was initiated as part of TIGTA’s statutory requirements to annually review the adequacy and security of IRS technology.  The overall objective was to determine whether the IRS business resumption plans are adequate to restore critical business processes after a disaster or an emergency event.

WHAT TIGTA FOUND

The IRS’ ability to recover its critical processes is strengthened by its extensive redundant operations and its experience in recovering from previous disasters and emergency incidents.  However, most of the IRS business resumption plans that TIGTA reviewed lacked detailed planning and recovery strategies that would facilitate an efficient recovery of the IRS business processes.

Some business resumption team leaders were cognizant of the recovery details and strategies, but they did not document this information in their plans.  Documentation of the details and strategies in the business resumption plans would facilitate recovery and could be crucial if key employees are unavailable after a disaster.

The lack of detail is generally due to control weaknesses and insufficient oversight.  Some business functions did not establish a review process or a central repository to ensure the quality and control of the plans.  The IRS created two templates to guide business functions on how to prepare the plans.  However, because use of the templates was not mandatory, the business functions often used different templates.  In addition, the Emergency Management and Preparedness Executive Steering Committee, which is responsible for overseeing the business resumption plans, had met only once since being established in July 2004.

Plans are required to be tested and updated each year.  However, the business units had not tested in Calendar Year 2007 54 percent of the plans that TIGTA reviewed.  When plans were tested, the scopes were insufficient to identify gaps, omissions, and weaknesses.  In addition, 38 percent of the plans TIGTA evaluated had not been updated in Calendar Year 2007.  TIGTA attributed these conditions to a lack of emphasis by management.

WHAT TIGTA RECOMMENDED

TIGTA recommended that the Chief, Agency-Wide Shared Services 1) instruct business units with a significant number of sites to establish a business resumption coordinator position to perform a quality review of each plan within the function and to create a central repository to control the plans, 2) mandate use of the standard templates and require all business resumption coordinators to periodically brief the Emergency Management and Preparedness Executive Steering Committee on the completeness and adequacy of the business resumption plans, 3) develop specific testing requirements and procedures for business resumption plans based on risk, and 4) instruct the Emergency Management and Preparedness Executive Steering Committee to require business units to plan and conduct testing, document test results, and update business resumption plans annually, as well as monitor testing activities conducted by the business units.

In their response to the report, IRS officials stated their agreement with the findings and recommendations.  The IRS plans to coordinate the establishment of full-time business coordinator positions and to direct the use of standardized continuity templates.  The Emergency Management and Preparedness Executive Steering Committee plans to receive periodic briefings from select business coordinators.  The IRS plans to develop criteria for a multi-year testing, training, and exercise strategy that will be consistent with Federal Government continuity directives.

READ THE FULL REPORT

To view the report, including the scope, methodology, and full IRS response, go to:

http://www.treas.gov/tigta/auditreports/2008reports/200820178fr.html.

Email Address:   inquiries@tigta.treas.gov

Phone Number:   202-622-6500

Web Site:   http://www.tigta.gov