TREASURY INSPECTOR GENERAL FOR TAX ADMINISTRATION

 

 

Accountability Over Volunteer Program Computers Has Significantly Improved, but Providing Computers to Volunteers Presents Many Challenges

 

 

 

May 7, 2010

 

Reference Number:  2010-40-053

 

 

This report has cleared the Treasury Inspector General for Tax Administration disclosure review process and information determined to be restricted from public release has been redacted from this document.

 

Phone Number   |  202-622-6500

Email Address   |  inquiries@tigta.treas.gov

Web Site           |  http://www.tigta.gov

 

HIGHLIGHTS

ACCOUNTABILITY OVER VOLUNTEER PROGRAM COMPUTERS HAS SIGNIFICANTLY IMPROVED, BUT PROVIDING COMPUTERS TO VOLUNTEERS PRESENTS MANY CHALLENGES

Highlights

Final Report issued on May 7, 2010

Highlights of Report Number:  2010-40-053 to the Internal Revenue Service Chief Technology Officer and the Commissioner for the Wage and Investment Division.

IMPACT ON TAXPAYERS

In an effort to promote electronic filing (e‑filing), the Internal Revenue Service (IRS) provides computers to enable Volunteer Program sites to offer taxpayers the option of e‑filing their tax returns.  The IRS maintains an inventory of more than 12,000 computers for the Volunteer Program, which creates significant challenges for the IRS, particularly with ensuring the computers are accounted for and are operating.  When computers are not accounted for and not operating, the risk increases that taxpayer data will be unprotected and taxpayers will not be able to have their tax returns prepared.

WHY TIGTA DID THE AUDIT

The overall objective of this review was to assess whether computers used in the Volunteer Program are properly accounted for and controlled.  The IRS requested this review.  It is a followup to a prior TIGTA report, Accountability Over Volunteer Income Tax Assistance Program Computers Continues to Be a Problem (Reference Number 2006‑40‑172, dated September 25, 2006).

WHAT TIGTA FOUND

The IRS has made significant improvements since the prior audits and has implemented sufficient controls over the computers used in the Volunteer Program.  The IRS stores the computers at its Computer Depot.  Tests showed that computers assigned to the Computer Depot were accounted for and taxpayer data were protected.  Most computers assigned to volunteers could be accounted for and were in operating condition. 

During Fiscal Year 2009, 20 Volunteer Program computers were reported as lost or stolen.  The IRS did not ensure the required procedures were followed when the computers were lost or stolen, and it had no procedures for notifying law enforcement agencies when stolen computers were recovered. 

The IRS is seeking changes to legislation that would allow it to donate computers to Volunteer Program partners.  It currently cannot donate the computers to Volunteer Program organizations because the law prohibits it.  The IRS must maintain the computers, loaning them out each filing season.  Considering the minimal value and the cost of maintaining and controlling the computers, the IRS’ plan to donate them to the partners to benefit tax administration has merit.

WHAT TIGTA RECOMMENDED

TIGTA recommended that the IRS implement a process to ensure law enforcement agencies are notified when stolen computers are recovered and ensure established procedures are followed when documenting lost or stolen Volunteer Program computers.

The IRS agreed with the recommendations.  It plans to implement a process to ensure law enforcement agencies are notified when a stolen computer is recovered and plans to re‑emphasize established procedures to document lost or stolen computers with partners and employees.

 

May 7, 2010

 

 

MEMORANDUM FOR CHIEF TECHNOLOGY OFFICER

                                         COMMISSIONER, WAGE AND INVESTMENT DIVISION

 

FROM:                            Michael R. Phillips /s/ Michael R. Phillips

                                         Deputy Inspector General for Audit

 

SUBJECT:                    Final Audit Report – Accountability Over Volunteer Program Computers Has Significantly Improved, but Providing Computers to Volunteers Presents Many Challenges (Audit # 200940046)

 

This report presents the results of our review to assess whether computers used in the Volunteer Program are properly accounted for and controlled.  This review was requested by the Internal Revenue Service and is a followup to a prior Treasury Inspector General for Tax Administration report.[1]  This audit is included in our Fiscal Year 2010 Annual Audit Plan and addresses the major management challenges of Security, Taxpayer Protection and Rights, and Providing Quality Taxpayer Service Operations.

Management’s complete response to the draft report is included in Appendix VI.

Copies of this report are also being sent to the Internal Revenue Service managers affected by the report recommendations.  Please contact me at (202) 622-6510 if you have questions or Michael E. McKenney, Assistant Inspector General for Audit (Returns Processing and Account Services), at (202) 622-5916.

 

 Table of Contents

 

Background

Results of Review

Controls Over Volunteer Program Computers Have Significantly Improved

Controlling and Maintaining Volunteer Program Computers Comes at a Considerable Cost to the Internal Revenue Service

Recommendations 1 and 2:

Appendices

Appendix I – Detailed Objective, Scope, and Methodology

Appendix II – Major Contributors to This Report

Appendix III – Report Distribution List

Appendix IV – Managing and Controlling Volunteer Program Computers

Appendix V – Procedures for Reporting and Documenting Lost or Stolen Computers

Appendix VI – Management’s Response to the Draft Report

  

Abbreviations

 

e-filing; e-file(d)

Electronic filing; electronically filed

IRS

Internal Revenue Service

ITAMS

Information Technology Asset Management System

SPEC

Stakeholder Partnerships, Education and Communication

STARS

SPEC Taxpayer Assistance Reporting System

TIGTA

Treasury Inspector General for Tax Administration

  

Background

 

Volunteers play an increasingly important role in helping the IRS achieve its goal of improving taxpayer service and facilitating participation in the tax system.

The Volunteer Program plays an increasingly important role in the achievement of the Internal Revenue Service’s (IRS) goal of improving taxpayer service and facilitating participation in the tax system.  It provides no-cost Federal tax return preparation and electronic filing (e-filing) directed toward underserved segments of individual taxpayers, including low-income to moderate-income, elderly, disabled, and limited-English-proficient taxpayers.  It includes sites operated in partnership with the military and with various community-based organizations.[2]  The Volunteer Program is comprised of the Volunteer Income Tax Assistance Program, the Tax Counseling for the Elderly Program, and the Volunteer Income Tax Assistance Grant Program. 

In an effort to promote e‑filing, the IRS provides computers to enable Volunteer Program sites to offer taxpayers the option of e‑filing their tax returns.  These computers are loaded with the tax preparation software necessary to e‑file a tax return with the IRS.  For the 2009 Filing Season,[3] more than 82,000 volunteers staffed 12,160 Volunteer Program sites.  Volunteers prepared approximately 3 million individual income tax returns at Volunteer Program sites.  The IRS is expected to ship approximately 9,100 computers to Volunteer Program volunteers for the 2010 Filing Season.

Oversight of the Volunteer Program is the responsibility of the Stakeholder Partnerships, Education and Communication (SPEC) function, located within the IRS Wage and Investment Division.  However, the computers volunteers use in the Volunteer Program are also the responsibility of the IRS’ Modernization and Information Technology Services organization.

This audit is a followup to two prior Treasury Inspector General for Tax Administration (TIGTA) audits[4] that determined the IRS did not have sufficient controls over the Volunteer Program computers.  In August 2002, we reported that the IRS did not have adequate internal controls and accountability over the computers it provided to volunteers.  The IRS could not physically account for computers provided to Volunteer Program volunteers.  This happened because the IRS did not consistently conduct the required annual certification of the Information Technology and Asset Management System (ITAMS),[5] immediately record receipt of new computers on the ITAMS, and update inventory records when equipment was delivered.

In September 2006, we again reported that key controls designed by the IRS to assist in accounting for computers were not consistently being followed.  During this review, much of the information provided to support the accounting for Volunteer Program computers was inconsistent and changed throughout the course of the audit.  Though the IRS accounted for 97 percent (191 of 197) of the computers sampled, repeated attempts were necessary to locate the computers.  Additionally, the IRS did not ensure required procedures were followed when recording the disposal of computers on the ITAMS.

The IRS took actions to address concerns, which included certifying the Volunteer Program computer inventory beginning in Fiscal Year 2006, developing guidelines outlining responsibilities of the SPEC and the End User Equipment and Services functions, and monitoring and limiting the ability to change the ITAMS name data field.

This audit was conducted at the request of the Modernization and Information Technology Services organization.  It suggested that the TIGTA conduct a review of the Volunteer Program’s information technology program management to include asset management, sensitive taxpayer data security requirements adherence, and financial resource management.

This review was performed at the Wage and Investment Division’s SPEC function in AtlantaGeorgia, and End User Equipment and Services function at the Brookhaven Campus[6] in Holtsville, New York, during the period September 2009 through February 2010.  This performance audit was conducted in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objective.  We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective.  Detailed information on our audit objective, scope, and methodology is presented in Appendix I.  Major contributors to the report are listed in Appendix II.

 

 

Results of Review

 

Controls Over Volunteer Program Computers Have Significantly Improved

The IRS has made significant improvements since the prior audits and has implemented sufficient controls over the computers used in the Volunteer Program.  The IRS stores the computers at its Computer Depot,[7] and they are controlled on two different computer systems—the ITAMS and SPEC Taxpayer Assistance Reporting System (STARS).

Tests of computers controlled on the STARS showed that computers assigned to the Computer Depot were accounted for and controlled.[8]  Additionally, most computers assigned to volunteers could be accounted for and were in operating condition.

·        51 (100 percent) of 51 computers assigned to the Computer Depot were accounted for.  Forty-one were located at the Computer Depot and 10 computers had been shipped to volunteers prior to testing.  Additionally, for the 41 computers located at the Computer Depot, testing showed the computers were operational and that no taxpayer data were found.

·        33 (66 percent) of 50 computers assigned to volunteers were verified by the volunteers as being in their possession.  Adequate documentation was not received from 13 (26 percent) volunteers and 1 (2 percent) computer that had been reassigned to the Computer Depot could not be accounted for.  No response was received from the volunteers who were assigned the remaining 3 (6 percent) of the 50 computers.

·        40 (80 percent) of 50 computers assigned to volunteers were operational; 3 (6 percent) were reported as not operational.  The operating status of the other seven could not be determined because the computers were returned to the Computer Depot and were not tested or the volunteers did not respond when asked if their computers were operating.  However, 1 partner[9] responded that 18 computers were received for the 2010 Filing Season and 6 (33 percent) were not operational.

Additionally, the most recent annual inventory certification was completed on July 22, 2009, and 12,601 computers were certified.  Twenty-nine computers were placed in a pending status on the ITAMS but were located and certified by September 30, 2009.  An annual inventory certification of computers located at the Computer Depot involves touching each computer controlled on the ITAMS and certifying that the computer has been located.

The IRS uses two computer systems to control Volunteer Program computers

The STARS inventory system is used to account for Volunteer Program computers because the ITAMS cannot capture information specific to the Volunteer Program—the partner, site, or volunteer assigned to each computer.  This information is captured on the STARS.  In Calendar Year 2010, the IRS will be replacing the ITAMS and STARS.

As a result of prior recommendations, the IRS has strengthened its controls over the Volunteer Program computers by integrating the ITAMS and STARS.  In an effort to ensure the STARS and ITAMS agree, we conducted limited testing during this review and did not identify any major weaknesses identified in prior TIGTA reports.  However, because the IRS is in the process of implementing two new systems that will replace the ITAMS and STARS, it is essential that the current information is accurate and that similar controls are in place to maintain the integrity of the information.

Controlling and Maintaining Volunteer Program Computers Comes at a Considerable Cost to the Internal Revenue Service

The strengths of the Volunteer Program lie in its volunteers and partner organizations.  However, relying on volunteers to deliver the Program has inherent risks.  Further, maintaining an inventory of more than 12,000 laptop computers to be supplied to volunteers creates significant challenges for the IRS, particularly ensuring the computers are controlled and are operating.

The IRS loans computers to volunteers to promote e-filing and provide free tax return preparation to taxpayers.  The IRS estimates that it costs approximately $3.8 million annually to maintain Volunteer Program computers.[10] 

The Volunteer Program computers are computers that have become obsolete.  Once computers used by IRS employees become outdated, they are transferred to the Computer Depot for use by the Volunteer Program.  When the Computer Depot receives a computer from an IRS function, a Computer Depot employee updates the ITAMS to show the computer is located at the Computer Depot.  When selected for use in the upcoming filing season, a Computer Depot employee:

  • Ensures the computer is in good working order and that no taxpayer data are on the hard drive, performs maintenance and imaging, and loads tax preparation software.  This takes approximately 3 hours.
  • Prepares a packing list.
  • Packages and ships the computer with the peripherals to the Volunteer Program partner, who then provides the computer either to the Volunteer site coordinators or directly to the volunteer.
  • Updates the ITAMS to show the computer is in use and is no longer in stock in the Computer Depot.

For computer orders, a SPEC function employee:

  • Receives the order from the partner.
  • Notifies the Computer Depot of the partner’s request.
  • Ensures the STARS reflects the contact information and location of the computer.

When the STARS is updated, the ITAMS is systemically updated showing the most current information.

If a volunteer has problems with a computer, he or she must package and ship it back to the IRS Computer Depot and the IRS must ship another computer to the volunteer.  Since these computers are not considered the property of the volunteers or partners, each computer, even if inoperable, must be accounted for.  Additionally, the IRS conducts an annual inventory and certification of all computers.

The Computer Depot replaced 1,087 computers during the 2009 Filing Season and 340 computers between January 1 and February 16, 2010.

The Computer Depot replaced 1,087 computers (640 through helpdesk requests by volunteers plus 447 through proactive replacements due to failed batteries) during the 2009 Filing Season and 340 computers between January 1 and February 16, 2010.  Additionally, during a current TIGTA audit,[11] a review of a Volunteer Program site found problems with printers a SPEC function Territory[12] provided to the site.  For example, some printers were not operable and had to be replaced.  Others were not compatible with the volunteers’ non-IRS computers.  The printer drivers[13] required to print tax returns were not included with the printers or loaded on the computer.  This situation required that the Territory provide additional resources to ensure the site was operational.

The IRS requires that the computers be shipped back to the Computer Depot each year by May 15.  At that time, the partners are responsible for wiping the computers clean of all taxpayer data.  The IRS employees must unpack the computer and peripherals and update the ITAMS to show the computer has been returned.

Though few computers were stolen, procedures are not always followed when documenting and reporting the loss and procedures are not adequate when computers are recovered

During Fiscal Year 2009, 20 (0.17 percent) Volunteer Program computers out of approximately 12,000 computers were reported as lost or stolen.  Ten of these were in the possession of volunteers at the time they went missing.  When the IRS or volunteers determine that computers are lost or stolen, significant resources are needed to complete the paperwork and follow the procedures required to ensure all steps have been taken to locate the computers.  The computers themselves hold very little value but can contain taxpayer information.  However, all computers are encrypted and require a password, reducing the risk of disclosing taxpayer information.

Not all procedures were followed when documenting and reporting lost and stolen computers.  The IRS guidelines require employees to research and attempt to locate computers to protect IRS assets and taxpayer information by completing the following:[14]

1)      Performing a physical search for the computer based on location and contact information reflected in the ITAMS and/or STARS.

2)      Contacting the last person responsible for possession of the computer.

3)      Contacting the responsible person.

4)      Contacting the TIGTA Office of Investigations.

5)      Contacting the local police department.

6)      Determining whether taxpayer data were at risk.

A test of 20 computers reported lost or stolen showed proper procedures were not followed and documentation was not maintained for 13 (65 percent).

·        3 (15 percent) computers assigned to volunteers had documentation that was not adequate to determine whether the loss or theft was timely reported to the IRS.  Two computers showed that taxpayer data were on the computers when stolen, but the number of taxpayers whose data were at risk could not be determined.  According to the documentation, the number of taxpayers ranged from 2 to 300. 

·        2 (10 percent) computers did not have documents adequate to determine who was in possession of the computer or whether the loss or theft was timely reported.

·        8 (40 percent) computers were missing while assigned to the Computer Depot.  The Computer Depot employees believe these computers were previously retired but scanned into the inventory in error while still at the Computer Depot.

Three of the 20 computers reported as lost or stolen were shown in the ITAMS as recovered and were included in the IRS’ annual certification.  However, there was no documentation in the file and no notification made to the local police department and the TIGTA Office of Investigations of the computers being located.  The IRS stated there are no procedures, other than updating the ITAMS, for documenting recovered computers or notifying law enforcement agencies that the computers have been recovered.

A prior TIGTA report[15] stated that the IRS did not ensure required procedures were followed when documenting lost computers.  The IRS is still not ensuring that procedures for reporting and documenting lost or stolen computers are being followed, and because of inadequate documentation, the reliability of the information could not be substantiated.  As a result of not notifying law enforcement agencies when computers are recovered, the law enforcement agencies are expending resources by continuing to investigate stolen computers that the IRS has found.  Additionally, even though IRS computers loaned to the Volunteer Program sites are encrypted, which mitigates risk to taxpayer data, encryption is not failsafe.  As a result of not following procedures and having inadequate documentation, there is still a risk that taxpayer data are not entirely safe and secure.

The IRS is seeking a change to legislation to allow it to donate computers to Volunteer Program partners

The IRS does not purchase new computers for the Volunteer Program, but provides computers it considers outdated and no longer suitable for its employees.  It cannot donate the computers to the Volunteer Program partners because the law[16] prohibits the donation of computers to volunteers.  Therefore, the IRS must maintain the computers, loaning them out each filing season.

In Calendar Year 2007, the IRS began developing a plan to discontinue the practice of loaning computers to its Volunteer Program partners.  Rather than loan the computers, the IRS would prefer to donate the computers to the partners and supplement the resources on an as-needed basis.  For example, if computers become inoperable, the IRS would donate another computer but not have the broken computer returned for tracking, repair, and/or disposal.  Rather, the volunteer or partner would own the computer and be responsible for maintenance and disposal of the computer.  The IRS also provides printers to the volunteers, but would discontinue providing printers.

The IRS has worked with some partners to assist them in purchasing their own computers.  For example, the SPEC function is actively working with the AARP to use grant money to purchase its own computers.  The IRS loaned the AARP about 5,500 computers for the 2010 Filing Season (more than one half of the 9,100 computers loaned).

In December 2007, Congress first appropriated funds to the IRS to establish and administer a Volunteer Income Tax Assistance Grant Program in which grantees are awarded matching grants to extend services to underserved populations in hardest‑to‑reach areas, both urban and nonurban.  In Fiscal Year 2009, the IRS awarded almost $8 million in matching grants to 111 organizations that planned to offer free tax preparation sites during the 2009 Filing Season.  In Fiscal Year 2010, $8 million was awarded to 147 organizations for the 2010 Filing Season.  The IRS believes that these Volunteer Income Tax Assistance Grant Program funds could be used to purchase computers.

One SPEC function Territory no longer provides Volunteer Program computers to non-AARP[17] partners.  The Territory developed a plan in July 2006 to become equipment free over a 2-year period.  By working with its partners, the Territory achieved its goal by May 2008.  During the process, no partners left the Volunteer Program and there was no reduction in the number of tax returns prepared.  Moreover, the Territory e-filing growth rate exceeded the national and Area average for each of the 2 years.

The IRS believes reducing the partners’ reliance on IRS computers would benefit both the IRS and the Volunteer Program partners.  For the IRS, there is a significant cost savings.  For the partners, there is increased self-sufficiency and the use of more stable equipment.

However, not all partners may have the resources to purchase, set up, and maintain their own computers.  Additionally, partners may have expectations of continued equipment loans and have no incentive to become self-sufficient.  If the IRS stops loaning computers, there is a risk of some partners leaving the Volunteer Program.

The SPEC function must balance the needs of the volunteers with the IRS’ mission and goals.  As it strives to achieve its mission and goals and provides accountability for its operations, the SPEC function has to continually assess and evaluate the Volunteer Computer Program.  Considering the minimal value of the computers and the cost of maintaining and controlling them, the IRS’ plan to donate the computers to the partners to benefit tax administration has merit.

Recommendations

Recommendation 1:  The Chief Technology Officer should implement a process to ensure law enforcement agencies are notified when a stolen computer is recovered.

Management’s Response:  IRS management agreed with this recommendation.  The Asset Management Program Office will implement an Asset Management Directive that will update the process for stolen computers and provide guidance on ensuring law enforcement agencies are notified when a stolen computer is recovered.

Recommendation 2:  The Commissioner, Wage and Investment Division, should ensure established procedures, such as fully completing the lost or stolen checklist, are followed when documenting lost or stolen Volunteer Program computers.

Management’s Response:  IRS management agreed with this recommendation.  The SPEC function office will re-emphasize established procedures to document lost or stolen Volunteer Program computers with partners and SPEC function employees.  This message will be conveyed via all employee conference calls, partner calls, and email notification.

 

Appendix I

 

Detailed Objective, Scope, and Methodology

 

Our overall objective was to assess whether computers used in the Volunteer Program are properly accounted for and controlled.  To accomplish this objective, we: 

I.                    Determined whether the SPEC function properly controlled and accounted for Volunteer Program computers.

A.     Determined whether guidelines outlining the responsibilities of the SPEC function’s control and accountability of Volunteer Program computers have been developed and are clear and effective.

B.     Interviewed SPEC function management to determine its responsibilities.

C.     Requested a STARS and ITAMS extract from the Modernization and Information Technology Services. 

D.     Validated the reliability of the STARS[18] and ITAMS[19] data by comparing the two extracts to determine whether there were any discrepancies, tracing and verifying the data from the samples reflected in Steps I.E. and II.C., accessing the STARS and comparing the data, and receiving and comparing ITAMS screen prints from the Computer Depot[20] to the extracts.

E.      From the STARS extract, we selected a statistically valid sample of 50 computers from a population of 1,815 computers reflected as “in use.”  We used a confidence interval of 95 percent, a precision level of ±5 percent, and an expected error rate of 5 percent.  We determined the persons assigned the computers, contacted the individuals to determine whether they had possession of the computers and, if so, obtained the barcodes and serial numbers of the computers in their possessions.  We matched this information to our sample of inventory records to confirm the accuracy.  We also determined whether the computers were correctly controlled on the ITAMS.

F.      Determined whether the Computer Depot shipped defective computers to Volunteer Program sites by using the statistically valid sample in Step I.C.  We notified the person assigned the computer and determined the quality of the computer.

G.     Determined whether procedures are being followed when disposing of computers by obtaining the case files for lost or stolen computers.

II.                 Determined whether computers are properly controlled by the End User Equipment and Services function Computer Depot.

A.     Determined whether guidelines outlining the responsibilities of the End User Equipment and Services function Computer Depot control and accountability of Volunteer Program computers have been developed and are clear and effective.

B.     Interviewed Computer Depot management and obtained and reviewed Computer Depot’s guidelines to determine whether procedures for controlling and accounting for Volunteer Program computers are adequate.

C.     From the STARS, selected a statistically valid sample of 51 computers from a population of 10,333 computers that were physically located at the Computer Depot.  We used a confidence interval of 95 percent, a precision level of ±5 percent, and an expected error rate of 5 percent.  We determined whether the computers could be located and whether taxpayer data were found on the computers.  We also determined whether the computers were correctly controlled on the ITAMS.

Internal controls methodology

Internal controls relate to management’s plans, methods, and procedures used to meet their mission, goals, and objectives.  Internal controls include the processes and procedures for planning, organizing, directing, and controlling program operations.  They include the systems for measuring, reporting, and monitoring program performance.  We determined the following internal controls were relevant to our audit objective:  the IRS’ policies, procedures, and practices for controlling Volunteer Program computers.  We evaluated these controls by interviewing management, reviewing extracts, validating computer locations, and reviewing case files.

Appendix II

 

Major Contributors to This Report

 

Michael E. McKenney, Assistant Inspector General for Audit (Returns Processing and Account Services)

Augusta R. Cook, Director

Lena Dietles, Audit Manager

Roberta Fuller, Lead Auditor

Jerome Antoine, Auditor

Kathy Coote, Auditor

Nelva Usher, Auditor

 

Appendix III

 

Report Distribution List

 

Commissioner  C

Office of the Commissioner – Attn:  Chief of Staff  C

Deputy Commissioner for Services and Enforcement  SE

Deputy Commissioner, Wage and Investment Division  SE:W 

Director, Customer Account Services, Wage and Investment Division  SE:W:CAS

Director, Customer Assistance, Relationships, and Education, Wage and Investment Division  SE:W:CAR

Director, Strategy and Finance, Wage and Investment Division  SE:W:S

Associate CIO, End-User Equipment and Services  OS:CTO:EU

Senior Operations Advisor, Wage and Investment Division  SE:W:ETARC

Chief Counsel  CC

National Taxpayer Advocate  TA

Director, Office of Legislative Affairs  CL:LA

Director, Office of Program Evaluation and Risk Analysis  RAS:O

Office of Internal Control  OS:CFO:CPIC:IC

Audit Liaison:  Chief, Program Evaluation and Improvement, Wage and Investment Division  SE:W:S:PRA:PEI

 

Appendix IV

 

Managing and Controlling Volunteer Program Computers

 

All Volunteer Program computers are tracked and controlled on the ITAMS[21] and the STARS.[22]  Managers and partners/volunteers have responsibilities for maintaining and accounting for computers.  The following are steps that are required in tracking, maintaining, processing, and shipping Volunteer Program computers.

Computer Depot[23] Responsibilities

A Single Point Inventory Function updates the ITAMS (required within 10 days) when computers are transferred between local and field offices.

Shipping

1)      Laptops are pulled from inventory by first in, first out.

2)      Laptops are imaged, encrypted, and barcodes are scanned. 

3)      Laptops are cleaned by:

a.       Removing stickers.

b.      Performing system checks.

c.       Checking battery levels.

d.      Inputting to the ITAMS.

e.       Verifying serial numbers and barcodes.

4)      Laptops are placed in computer bags, packaged, and stored until shipped out to the volunteers. 

5)      Computers are packaged with all peripherals and sent to the partner or volunteer.

Inventory Reconciliation

1)      Inventory reconciliation occurs annually by June 30, during the recurring inventory cycle. 

2)      Laptops are reconciled by matching information gathered at the time of the inventory with that recorded in the ITAMS and can be done using a barcode scanner or through manual touch.

3)      Annually, after June 30, each office is sent a Reconciliation Plan along with a Certification letter that also includes the results from the analysis of the ITAMS.

4)      Outstanding errors found during the analysis have to be resolved by the end of the fiscal year.

5)      Lost or missing computers must have a Report of Survey (Form 1933) prepared.

Volunteer Responsibilities

The volunteers or partners have responsibilities in accounting for and verifying the receipt of laptops. 

Receipt of Laptops

1)      Verify that the equipment received matches the packing list. 

2)      Sign and return the packing list to the Computer Depot within 20 days of receipt.

3)      Verify the receipt of the laptop and mail the Property Loan Agreement to the SPEC function within 20 days. 

4)      Charge the laptop battery for 24 hours before using the computer.

Returning the Laptops

1)      Delete (wipe) data from the laptop’s hard drive before returning it. 

2)      Ship the laptop, using the same shipping box and packing materials the laptop was received in, to the Computer Depot by May 15.

SPEC Function Responsibilities

There are three areas within the SPEC function that are involved in the loan of computers to the Volunteer Program sites.

SPEC Headquarters

1)      Coordinates with the Computer Depot to share SPEC function needs and answers any questions the Computer Depot employees have.

2)      Provides guidance for equipment orders, return of equipment, and STARS equipment maintenance with the Area.[24]

3)      Places all equipment orders with the Computer Depot in a mutually agreed format.

4)      Provides information to the Area analysts relating to the Computer Depot, equipment, annual inventory actions, orders, problems, etc.

5)      Communicates changes/corrections needed in the STARS to the Area.

6)      Facilitates any changes to the STARS concerning equipment at the Computer Depot.

7)      Ensures publications, forms, and documents related to the Volunteer Program computers are updated as needed.

SPEC Area

1)      Ensures the Territory offices complete computer orders and notify SPEC headquarters analysts of any anomalies with orders and/or shipments made to the Territory or partner.

2)      Communicates between SPEC Headquarters and the Territory.

3)      Ensures the Territory, Area, and SPEC Headquarters is informed of concerns relating to the Computer Depot, equipment, annual inventory actions, orders, etc. and any problems raised by the partners/volunteers relating to the equipment, orders, use, etc.

4)      Conducts Territory reviews of equipment controlled in the STARS.

5)      Ensures Territories respond to SPEC Headquarter and Area requests for action.

6)      Ensures Territories complete annual equipment certification actions.

7)      Shifts equipment among its territories to ensure the greatest return on investment[25] while balancing service coverage.  This includes ensuring equipment is used only for its intended purpose.

SPEC Territory

1)      Determines the technology needs of its partners.

2)      Works with the Area Office to obtain additional resources when needed.

3)      Ensures equipment is used at an optimum level to balance with return on investment and service coverage.

4)      Ensures that Volunteer Income Tax Assistance/Tax Counseling for the Elderly equipment is used only for the Volunteer Program.

5)      Places all equipment orders as requested by the partners.

6)      Confirms order information and delivery with partners/volunteers to ensure accurate delivery.

7)      Secures Statement of Assurance Concerning Civil Rights Compliance for Internal Revenue Service SPEC Partnerships (Form 13325) or the Internal Revenue Service Civil Rights Assurance for Sub-recipients under SPEC Partnership Agreements (Form 13324) prior to delivery of the equipment.

8)      Ensures the STARS correctly reflects contact information to ensure accurate completion of documentation of shipments by the Computer Depot.

9)      Ensures the STARS correctly reflects the location of equipment at all times.

10)  Communicates important information relating to the use of the equipment to partners/volunteers, such as passwords, use of equipment, etc.

11)  Responds promptly to Area/Headquarter questions or concerns relating to the equipment.

12)  Secures the Property Loan Agreement on loaned equipment and provides it to the Computer Depot in accordance with Annual Certification procedures.

13)  Reports, secures, and maintains documentation on lost and/or stolen equipment.

14)  Conducts site visits and reviews.

15)  Apprises Area analysts of any problems relating to the equipment, orders, inventory, use, etc.

 

Appendix V

 

Procedures for Reporting and Documenting Lost or Stolen Computers

 

To ensure proper reporting of lost or stolen IRS equipment, the IRS Relationship Manager gathers as much information as possible about the lost or stolen equipment from the initial contact with the Volunteer Program participant.  A Checklist for Stolen Equipment (Form 13747) [26] is used to document the theft.  It requires that the Relationship Manager:

1)      Immediately notify the local Territory[27] manager and report the theft within 1 hour of notification to the Computer Security Incident Response Capability office.

2)      Contact the TIGTA Office of Investigations.

3)      Contact Customer Assistance, Relationships, and Education function and SPEC function management. 

4)      Contact the Volunteer Program Computer Depot.[28]

5)      If tax return information was present, determine the need to notify the impacted taxpayers. 

6)      Determine location of the IRS equipment when it was stolen and record barcode, serial number, manufacturer, and model. 

7)      If equipment has been stolen more than once, determine if equipment will continue to be loaned to the partner.

8)      Report to the police and request a copy of the local police report. 

9)      Attach a copy of the Property Loan Agreement to an assessment memorandum.

10)  Update the STARS to reflect the theft of the equipment.

11)  Upon receipt in headquarters, review the package for completeness and share it with the Chief, Oversight and Analysis, and the Director, Field Operations.  The documentation package is mailed to the Computer Depot. 

12)  The Computer Depot employee should complete a Report of Survey (Form 1933) and follow the appropriate steps to remove the computer from the ITAMS.

 

Appendix VI

 

Management’s Response to the Draft Report

 

DEPARTMENT OF THE TREASURY

INTERNAL REVENUE SERVICE

WASHINGTON, DC 20224

 

 

 CHIEF TECHNOLOGY OFFICER

 

 

 

April 21 2010

 

 

MEMORANDUM FOR                      DEPUTY INSPECTOR GENERAL FOR AUDIT

 

FROM:                                                Terence V. Milholland /s/ Terence V. Milholland

Chief Technology Officer

 

SUBJECT:                                           Draft Audit Report – Accountability Over Volunteer Program computers Has Significantly Improved, but Providing Computers to Volunteers Presents Many Challenges (Audit # 200940046) (i-trak #2010-74082)

 

Thank you for the opportunity to review and respond to the subject audit report.  We appreciate your comments and observations.  The IRS continues to strive to ensure that taxpayer data are safe and secure.  The IRS has taken actions and addressed concerns by certifying the Volunteer Program computer inventory beginning in Fiscal Year 2006, developing guidelines outlining responsibilities of the Stakeholder Partnerships, education and Communication (SPEC) and the End User Equipment and Services (EUES) functions, and monitoring and limiting the ability to change the Information Technology asset Management System (ITAMS) name data field.

We disagree with the report’s statement “as a result of not following procedure and having inadequate documentation, there is still a risk that taxpayer data are not entirely safe and secure”.  We agree that there is still a need to continue to refine, update and follow the established procedures for reporting lost and recovered computers; however, Volunteer Program computers are all encrypted which creates a “brick” against unwanted or illegal entry.  As discussed previously, we are again requesting that this statement be removed from the report.

We acknowledge that our continued diligence is necessary in this effort.  We agree with the two recommendations made as a result of your audit and the attachment to this memo details our planned actions to implement them.

Your continued support and the assistance and guidance your team provides have been a valuable resource to our organization.  If you have any questions, please contact me at (202) 622-6800 or Darrin D. Brown, Director, Program Oversight, at (202)2883-4613.

Attachment

Attachment

RECOMMENDATION#1:  The Chief Technology Officer should implement a process to ensure law enforcement agencies are notified when a stolen computer is recovered.

 CORRECTIVE ACTION #1:  We agree with this recommendation.  The Asset Management Program Office (AMPO) will implement a process, an Asset management (AM) Directive that provides changes to the IRM 2.14.1, to ensure law enforcement agencies are notified when a stolen computer is recovered.  The AM Directive will update the process for stolen computers and provide guidance on ensuring law enforcement agencies are notified when a stolen computer is recovered.

 IMPLEMENTATION DATE:  June 1, 2010

 RESPONSIBLE OFFICIAL:  Associate Chief Information Officer, End User Equipment and Services

 CORRECTIVE ACTION MONITORING PLAN:  We enter accepted Corrective Actions into the Joint Audit Management Enterprise System (JAMES) and monitor them on a monthly basis until completion.

 RECOMMENDATION #2:  The Commissioner, Wage and Investment Division should ensure established procedures, such as fully completing the lost or stolen checklist, are followed when documenting lost or stolen Volunteer Program computers.

 CORRECTIVE ACTION #2:  We agree with this recommendation.  The IRS’s Stakeholder Partnerships, Education and Communication (SPEC) office will re-emphasize established procedures to document lost or stolen Volunteer Program computers with partners and SPEC employees.  This message will be conveyed via all employee conference calls, partner calls, and e-mail notification.

IMPLEMENTATION DATE:  May 15, 2010

RESPONSIBLE OFFICIAL:  Director, Stakeholder, Partnerships, Education and Communication, Wage and Investment Division

CORRECTIVE ACTION MONITORING PLAN:  We enter accepted Corrective Actions into the Joint Audit Management Enterprise System (JAMES) and monitor them on a monthly basis until completion.



[1] Accountability Over Volunteer Income Tax Assistance Program Computers Continues to Be a Problem (Reference Number 2006-40-172, dated September 25, 2006).

[2] Some community-based Volunteer Program sites are located in buildings occupied by one or more IRS offices.

[3] The filing season is the period from January through mid-April when most individual income tax returns are filed.

[4] Computers Used to Provide Free Tax Help and That Contain Taxpayer Information Cannot Be Accounted For (Reference Number 2002-40-144, dated August 13, 2002) and Accountability Over Volunteer Income Tax Assistance Program Computers Continues to Be a Problem (Reference Number 2006-40-172, dated September 25, 2006).

[5] The ITAMS is the IRS’ authoritative record for asset control, where each piece of equipment is tracked from procurement to disposal.

[6] The data processing arm of the IRS.  The campuses process paper and electronic submissions, correct errors, and forward data to the Computing Centers for analysis and posting to taxpayer accounts.

[7] A centralized location that receives computers for the Volunteer Program, prepares them for use by loading the operating system and tax preparation software, ships them to volunteers, and stores them when they are not in use.

[8] Two statistically valid samples of 51 and 50 computers were selected.  Three tests were conducted on these 101 computers.  See Appendix I for details of the selection methodology.

[9] The IRS partners with various organizations—corporate, faith-based, non-profit, educational, financial, and government—to combine resources and goals to assist taxpayers in satisfying their tax responsibilities.

[10] See Appendix IV for lists of actions taken to control Volunteer Program computers.

[11] Quality of Services at Volunteer Program Sites During the 2010 Filing Season – Followup (Audit # 201040018).

[12] The SPEC function is divided geographically into 4 Areas and 37 Territories.

[13] Software that converts data to be printed to the form specific to a printer.

[14] See Appendix V for details of the required procedures.

[15] Accountability Over Volunteer Income Tax Assistance Program Computers Continues to Be a Problem (Reference Number 2006-40-172, dated September 25, 2006).

[16] Pub. L. No. 81-152, 63 Stat. 377 (codified as amended in scattered sections of 40 U.S.C. and 41 U.S.C.).

[17] AARP computer requirements are processed through SPEC function Headquarters, whereas non-AARP computer requirements are processed through the Territory.

[18] The SPEC function’s computer system that is used to control Volunteer Program computers.

[19] The IRS’ authoritative record for asset control, where each piece of equipment is tracked from procurement to disposal.

[20] A centralized location that receives computers for the Volunteer Program, prepares them for use by loading the operating system and tax preparation software, ships them to volunteers, and stores them when they are not in use.

[21] The IRS’ authoritative record for asset control, where each piece of equipment is tracked from procurement to disposal.

[22] The SPEC function’s computer system that is used to control Volunteer Program computers.

[23] A centralized location that receives computers for the Volunteer Program, prepares them for use by loading the operating system and tax preparation software, ships them to volunteers, and stores them when they are not in use.

[24] The SPEC function is divided geographically into 4 Areas and 37 Territories.

[25] The net profit or loss in an accounting period divided by the capital investment used during the period, usually expressed as an annual percentage return.

[26] The reverse of the form is completed for lost equipment.

[27] The SPEC function is divided geographically into 4 Areas and 37 Territories.

[28] A centralized location that receives computers for the Volunteer Program, prepares them for use by loading the operating system and tax preparation software, ships them to volunteers, and stores them when they are not in use.