Accountability Over Volunteer Program Computers Has Significantly Improved, but Providing Computers to Volunteers Presents Many Challenges
May 7, 2010
Reference Number: 2010-40-053
This report has cleared the Treasury Inspector General for Tax Administration disclosure review process and information determined to be restricted from public release has been redacted from this document.
Phone Number |
202-622-6500
Email Address | inquiries@tigta.treas.gov
Web Site |
http://www.tigta.gov
HIGHLIGHTS
ACCOUNTABILITY OVER VOLUNTEER PROGRAM COMPUTERS HAS
SIGNIFICANTLY IMPROVED, BUT PROVIDING COMPUTERS TO VOLUNTEERS PRESENTS MANY
CHALLENGES
Highlights
Final Report issued on May 7,
2010
Highlights of Report
Number: 2010-40-053 to the Internal
Revenue Service Chief Technology Officer and the Commissioner for the Wage and
Investment Division.
IMPACT ON TAXPAYERS
In an effort to promote
electronic filing (e‑filing),
the Internal Revenue Service (IRS) provides computers to enable Volunteer
Program sites to offer taxpayers the option of e‑filing their tax returns.
The IRS maintains an inventory of more than 12,000 computers for the
Volunteer Program, which creates significant challenges for the IRS,
particularly with ensuring the computers are accounted for and are operating.
When computers are not accounted for and not
operating, the risk increases that taxpayer data will be unprotected and
taxpayers will not be able to have their tax returns prepared.
WHY TIGTA DID THE AUDIT
The overall objective of this review was to assess whether
computers used in the Volunteer Program are properly accounted for and
controlled. The IRS requested this
review. It is a followup to a prior TIGTA
report, Accountability Over Volunteer
Income Tax Assistance Program Computers Continues to Be a Problem (Reference
Number 2006‑40‑172, dated September 25, 2006).
WHAT
TIGTA FOUND
The IRS has
made significant improvements since the prior audits and has implemented
sufficient controls over the computers used in the Volunteer Program. The IRS stores the computers at its Computer
Depot.
Tests
showed that computers assigned to the Computer Depot were accounted for and
taxpayer data were protected. Most
computers assigned to volunteers could be accounted for and were in operating
condition.
During Fiscal
Year 2009, 20 Volunteer Program computers were reported as lost or stolen. The IRS did not ensure the required
procedures were followed when the computers were lost or stolen, and it had no
procedures for notifying law enforcement agencies when stolen computers were
recovered.
The
IRS is seeking changes to legislation that would allow it to donate computers
to Volunteer Program partners. It
currently cannot donate the computers to Volunteer Program organizations because
the law prohibits it. The IRS must
maintain the computers, loaning them out each filing season. Considering the minimal value and the cost of
maintaining and controlling the computers, the IRS’ plan to donate them to the
partners to benefit tax administration has merit.
WHAT TIGTA RECOMMENDED
TIGTA
recommended that the IRS implement a process to ensure law enforcement
agencies are notified when stolen computers are recovered and ensure
established procedures are followed when documenting lost or stolen Volunteer
Program computers.
The IRS
agreed with the recommendations. It
plans to implement a process to ensure law enforcement agencies are notified
when a stolen computer is recovered and plans to re‑emphasize established
procedures to document lost or stolen computers with partners and employees.
May 7, 2010
MEMORANDUM FOR CHIEF TECHNOLOGY OFFICER
COMMISSIONER, WAGE AND INVESTMENT DIVISION
FROM: Michael R. Phillips /s/ Michael R. Phillips
Deputy Inspector General for Audit
SUBJECT: Final Audit Report – Accountability Over Volunteer Program Computers Has Significantly Improved, but Providing Computers to Volunteers Presents Many Challenges (Audit # 200940046)
This report presents the results of our review to assess
whether computers used in the Volunteer
Program are properly accounted for and controlled. This review was requested by the Internal
Revenue Service and is a followup to a prior Treasury Inspector General for Tax
Administration report.[1] This
audit is included in our Fiscal Year 2010 Annual Audit Plan and addresses the major
management challenges of Security, Taxpayer Protection and Rights, and Providing
Quality Taxpayer Service Operations.
Management’s complete response to the draft report is included in Appendix VI.
Copies of this report are also being sent to the Internal Revenue Service managers affected by the report recommendations. Please contact me at (202) 622-6510 if you have questions or Michael E. McKenney, Assistant Inspector General for Audit (Returns Processing and Account Services), at (202) 622-5916.
Controls Over Volunteer Program Computers Have Significantly
Improved
Appendices
Appendix
I – Detailed Objective, Scope, and Methodology
Appendix
II – Major Contributors to This Report
Appendix
III – Report Distribution List
Appendix
IV – Managing and Controlling Volunteer
Program Computers
Appendix
V – Procedures for Reporting and
Documenting Lost or Stolen Computers
Appendix
VI – Management’s Response to the Draft Report
Abbreviations
|
e-filing; e-file(d)
|
Electronic filing; electronically filed |
|
IRS |
Internal Revenue Service |
|
ITAMS |
Information Technology Asset Management System |
|
SPEC |
Stakeholder Partnerships, Education and
Communication |
|
STARS |
SPEC Taxpayer
Assistance Reporting System |
|
TIGTA |
Treasury Inspector General for Tax
Administration |
Volunteers
play an increasingly important role in helping the IRS achieve its goal of
improving taxpayer service and facilitating participation in the tax system.
The Volunteer Program plays an increasingly important role in the achievement of the Internal Revenue Service’s (IRS) goal of improving taxpayer service and facilitating participation in the tax system. It provides no-cost Federal tax return preparation and electronic filing (e-filing) directed toward underserved segments of individual taxpayers, including low-income to moderate-income, elderly, disabled, and limited-English-proficient taxpayers. It includes sites operated in partnership with the military and with various community-based organizations.[2] The Volunteer Program is comprised of the Volunteer Income Tax Assistance Program, the Tax Counseling for the Elderly Program, and the Volunteer Income Tax Assistance Grant Program.
In an effort to promote e‑filing, the IRS provides computers to enable Volunteer Program sites to offer taxpayers the option of e‑filing their tax returns. These computers are loaded with the tax preparation software necessary to e‑file a tax return with the IRS. For the 2009 Filing Season,[3] more than 82,000 volunteers staffed 12,160 Volunteer Program sites. Volunteers prepared approximately 3 million individual income tax returns at Volunteer Program sites. The IRS is expected to ship approximately 9,100 computers to Volunteer Program volunteers for the 2010 Filing Season.
Oversight of the Volunteer Program is the responsibility of the Stakeholder
Partnerships, Education and Communication
(SPEC) function, located within the IRS Wage and Investment Division. However, the computers volunteers use in the
Volunteer Program are also the responsibility of the IRS’ Modernization and
Information Technology Services organization.
This audit is a followup to two prior Treasury Inspector
General for Tax Administration (TIGTA) audits[4]
that determined the IRS did not have sufficient controls over the Volunteer
Program computers. In August 2002,
we reported that the IRS did not have adequate internal controls and
accountability over the computers it provided to volunteers. The IRS could not physically account for
computers provided to Volunteer Program volunteers. This
happened because the IRS did not consistently conduct the required annual certification
of the Information Technology and Asset Management System (ITAMS),[5] immediately
record receipt of new computers on the ITAMS, and update inventory records when
equipment was delivered.
In September 2006,
we again reported that key controls designed by the IRS to assist in accounting
for computers were not consistently being followed. During this review, much of the
information provided to support the accounting for Volunteer Program computers
was inconsistent and changed throughout the course of the audit. Though
the IRS accounted for 97 percent (191 of 197) of the computers
sampled, repeated attempts were necessary to locate the computers. Additionally, the IRS did not ensure required
procedures were followed when recording the disposal of computers on the ITAMS.
The IRS took actions
to address concerns, which included certifying the Volunteer Program computer
inventory beginning in Fiscal Year 2006, developing guidelines
outlining responsibilities of the SPEC and the End User Equipment and Services functions,
and monitoring and limiting the ability to change the ITAMS name data field.
This audit was conducted at the request of the Modernization
and Information Technology Services organization. It suggested that the TIGTA conduct a review
of the Volunteer
Program’s information technology program management to include asset management, sensitive taxpayer data security
requirements adherence, and financial resource management.
This review was performed at the Wage and Investment
Division’s SPEC function in
Controls Over Volunteer Program Computers Have Significantly Improved
The IRS has made significant improvements since the prior audits and has implemented sufficient controls over the computers used in the Volunteer Program. The IRS stores the computers at its Computer Depot,[7] and they are controlled on two different computer systems—the ITAMS and SPEC Taxpayer Assistance Reporting System (STARS).
Tests of computers controlled on
the STARS showed that computers assigned to the Computer Depot were accounted
for and controlled.[8]
Additionally, most computers assigned to volunteers could be accounted
for and were in operating condition.
·
51 (100 percent) of 51 computers assigned to the Computer Depot
were accounted for. Forty-one were
located at the Computer Depot and 10 computers had been shipped to volunteers
prior to testing. Additionally, for the 41 computers
located at the Computer Depot, testing showed the computers were operational
and that no taxpayer data were found.
·
33 (66 percent) of 50 computers assigned to volunteers were
verified by the volunteers as being in their possession. Adequate documentation was not received from 13
(26 percent) volunteers and 1 (2 percent) computer that had been reassigned to
the Computer Depot could not be accounted for.
No response was received from the volunteers who were assigned the
remaining 3 (6 percent) of the 50 computers.
· 40 (80 percent) of 50 computers assigned to volunteers were operational; 3 (6 percent) were reported as not operational. The operating status of the other seven could not be determined because the computers were returned to the Computer Depot and were not tested or the volunteers did not respond when asked if their computers were operating. However, 1 partner[9] responded that 18 computers were received for the 2010 Filing Season and 6 (33 percent) were not operational.
Additionally, the most recent annual
inventory certification was completed on July 22, 2009, and
12,601 computers were certified.
Twenty-nine computers were placed in a pending status on the ITAMS but
were located and certified by September 30, 2009. An annual inventory certification of
computers located at the Computer Depot involves touching each computer controlled
on the ITAMS and certifying that the computer has been located.
The IRS uses two computer systems to
control Volunteer Program computers
The STARS inventory system is used to account
for Volunteer Program computers because the ITAMS cannot capture information
specific to the Volunteer Program—the partner, site, or volunteer assigned to
each computer. This information is
captured on the STARS. In Calendar Year
2010, the IRS will be replacing the ITAMS and STARS.
As a result of prior recommendations, the IRS has strengthened its
controls over the Volunteer Program computers by integrating the ITAMS and
STARS. In an effort to ensure the STARS
and ITAMS agree, we conducted limited testing during this review and did not identify
any major weaknesses identified in prior TIGTA reports. However, because the IRS is in the process of
implementing two new systems that will replace the ITAMS and STARS, it is
essential that the current information is accurate and that similar controls
are in place to maintain the integrity of the information.
Controlling and Maintaining Volunteer Program Computers Comes at a Considerable Cost to the Internal Revenue Service
The
strengths of the Volunteer Program lie in its volunteers and partner
organizations. However, relying on
volunteers to deliver the Program has inherent risks. Further, maintaining an inventory of more than 12,000 laptop
computers to be supplied to volunteers creates significant challenges for the
IRS, particularly ensuring the computers are controlled and are operating.
The IRS loans computers to
volunteers to promote e-filing and provide
free tax return preparation to taxpayers.
The IRS estimates that it costs approximately $3.8 million annually to
maintain Volunteer Program computers.[10]
The Volunteer Program computers
are computers that have become obsolete.
Once computers used by IRS employees become outdated, they are
transferred to the Computer Depot for use by the Volunteer Program. When the Computer Depot receives a computer
from an IRS function, a Computer Depot employee updates the ITAMS to show the
computer is located at the Computer Depot.
When selected for use in the upcoming filing season, a Computer Depot
employee:
For computer orders, a SPEC
function employee:
When the STARS is updated, the ITAMS
is systemically updated showing the most current information.
If a volunteer has problems with
a computer, he or she must package and ship it back to the IRS Computer Depot
and the IRS must ship another computer to the volunteer. Since these computers are not considered the
property of the volunteers or partners, each computer, even if inoperable, must
be accounted for. Additionally, the IRS
conducts an annual inventory and certification of all computers.
The Computer Depot
replaced 1,087 computers during the 2009 Filing Season and 340 computers
between January 1 and February 16, 2010.
The Computer Depot replaced 1,087 computers (640 through helpdesk requests by volunteers plus 447 through proactive replacements due to failed batteries) during the 2009 Filing Season and 340 computers between January 1 and February 16, 2010. Additionally, during a current TIGTA audit,[11] a review of a Volunteer Program site found problems with printers a SPEC function Territory[12] provided to the site. For example, some printers were not operable and had to be replaced. Others were not compatible with the volunteers’ non-IRS computers. The printer drivers[13] required to print tax returns were not included with the printers or loaded on the computer. This situation required that the Territory provide additional resources to ensure the site was operational.
The IRS requires that the
computers be shipped back to the Computer Depot each year by May 15. At that time, the partners are responsible
for wiping the computers clean of all taxpayer data. The IRS employees must unpack the computer
and peripherals and update the ITAMS to show the computer has been returned.
Though few computers were stolen, procedures are not always followed when documenting and reporting the loss and procedures are not adequate when computers are recovered
During Fiscal Year 2009, 20 (0.17 percent) Volunteer Program computers out of approximately 12,000 computers were reported as lost or stolen. Ten of these were in the possession of volunteers at the time they went missing. When the IRS or volunteers determine that computers are lost or stolen, significant resources are needed to complete the paperwork and follow the procedures required to ensure all steps have been taken to locate the computers. The computers themselves hold very little value but can contain taxpayer information. However, all computers are encrypted and require a password, reducing the risk of disclosing taxpayer information.
Not
all procedures were
followed when documenting and reporting lost and stolen computers. The
IRS guidelines require employees to research and attempt to locate computers to
protect IRS assets and taxpayer information by completing the following:[14]
1)
Performing a physical search for the computer
based on location and contact information reflected in the ITAMS and/or STARS.
2)
Contacting the last person responsible for
possession of the computer.
3)
Contacting the responsible person.
4)
Contacting the TIGTA Office of
Investigations.
5)
Contacting the local police department.
6)
Determining whether taxpayer data were at
risk.
A test of 20 computers reported
lost or stolen showed proper procedures were not followed and documentation was
not maintained for 13 (65 percent).
· 3 (15 percent) computers assigned to volunteers had documentation that was not adequate to determine whether the loss or theft was timely reported to the IRS. Two computers showed that taxpayer data were on the computers when stolen, but the number of taxpayers whose data were at risk could not be determined. According to the documentation, the number of taxpayers ranged from 2 to 300.
· 2 (10 percent) computers did not have documents adequate to determine who was in possession of the computer or whether the loss or theft was timely reported.
· 8 (40 percent) computers were missing while assigned to the Computer Depot. The Computer Depot employees believe these computers were previously retired but scanned into the inventory in error while still at the Computer Depot.
Three of the 20 computers reported as lost or
stolen were shown in the ITAMS as recovered and were included in the IRS’
annual certification. However, there was
no documentation in the file and no notification made to the local police
department and the TIGTA Office of Investigations of the computers being
located. The IRS stated there are no
procedures, other than updating the ITAMS, for documenting recovered computers
or notifying law enforcement agencies that the computers have been recovered.
A prior TIGTA report[15] stated that the IRS did not
ensure required procedures were followed when documenting lost computers. The IRS is still not ensuring that procedures
for reporting and documenting lost or stolen computers are being followed, and
because of inadequate documentation, the reliability of the information could
not be substantiated. As a result of not
notifying law enforcement agencies when computers are recovered, the law
enforcement agencies are expending resources by continuing to investigate
stolen computers that the IRS has found.
Additionally, even though IRS computers loaned to the Volunteer Program
sites are encrypted, which mitigates risk to taxpayer data, encryption is not
failsafe. As a result of not following
procedures and having inadequate documentation, there is still a risk that
taxpayer data are not entirely safe and secure.
The IRS is seeking a change to legislation to allow it to donate computers to Volunteer Program partners
The IRS does not purchase new computers for
the Volunteer Program, but provides computers it considers outdated and no
longer suitable for its employees. It
cannot donate the computers to the Volunteer Program partners because the law[16] prohibits
the donation of computers to volunteers.
Therefore, the IRS must maintain the computers, loaning them out each
filing season.
In Calendar Year 2007, the IRS began developing a plan to discontinue the practice of loaning computers to its Volunteer Program partners. Rather than loan the computers, the IRS would prefer to donate the computers to the partners and supplement the resources on an as-needed basis. For example, if computers become inoperable, the IRS would donate another computer but not have the broken computer returned for tracking, repair, and/or disposal. Rather, the volunteer or partner would own the computer and be responsible for maintenance and disposal of the computer. The IRS also provides printers to the volunteers, but would discontinue providing printers.
The IRS has worked with some partners to assist
them in purchasing their own computers.
For example, the SPEC function is actively working with the AARP to use
grant money to purchase its own computers.
The IRS loaned the AARP about 5,500 computers for the 2010 Filing
Season (more than one half of the 9,100 computers loaned).
In
December 2007, Congress first appropriated funds to the IRS to establish and
administer a Volunteer Income Tax Assistance Grant Program in which grantees
are awarded matching grants to extend services to underserved populations in
hardest‑to‑reach areas, both urban and nonurban. In Fiscal Year 2009, the IRS awarded almost $8 million in matching
grants to 111 organizations that planned to offer free tax preparation
sites during the 2009 Filing Season. In Fiscal Year 2010, $8 million was
awarded to 147 organizations for the 2010 Filing Season. The
IRS believes that these Volunteer Income Tax Assistance Grant Program funds
could be used to purchase computers.
One SPEC function Territory no longer provides Volunteer Program computers to non-AARP[17] partners. The Territory developed a plan in July 2006 to become equipment free over a 2-year period. By working with its partners, the Territory achieved its goal by May 2008. During the process, no partners left the Volunteer Program and there was no reduction in the number of tax returns prepared. Moreover, the Territory e-filing growth rate exceeded the national and Area average for each of the 2 years.
The IRS believes reducing the partners’ reliance on IRS computers would benefit both the IRS and the Volunteer Program partners. For the IRS, there is a significant cost savings. For the partners, there is increased self-sufficiency and the use of more stable equipment.
However, not all partners may have the resources to purchase, set up, and maintain their own computers. Additionally, partners may have expectations of continued equipment loans and have no incentive to become self-sufficient. If the IRS stops loaning computers, there is a risk of some partners leaving the Volunteer Program.
The SPEC function must balance the needs of the volunteers with the IRS’ mission and goals. As it strives to achieve its mission and goals and provides accountability for its operations, the SPEC function has to continually assess and evaluate the Volunteer Computer Program. Considering the minimal value of the computers and the cost of maintaining and controlling them, the IRS’ plan to donate the computers to the partners to benefit tax administration has merit.
Recommendations
Recommendation
1: The Chief
Technology Officer should implement a process to ensure law enforcement
agencies are notified when a stolen computer is recovered.
Management’s Response:
IRS management agreed with
this recommendation. The Asset
Management Program Office will implement an Asset Management Directive that
will update the process for stolen computers and provide guidance on ensuring
law enforcement agencies are notified when a stolen computer is recovered.
Recommendation 2: The Commissioner, Wage and Investment
Division, should ensure established procedures, such as fully completing the
lost or stolen checklist, are followed when documenting lost or stolen
Volunteer Program computers.
Management’s Response:
IRS management agreed with
this recommendation. The SPEC function office
will re-emphasize established procedures to document lost or stolen Volunteer
Program computers with partners and SPEC function employees. This message will be conveyed via all
employee conference calls, partner calls, and email notification.
Appendix I
Detailed Objective, Scope, and Methodology
Our overall objective was to assess whether computers used in the Volunteer Program are properly accounted for and controlled. To accomplish this objective, we:
I.
Determined
whether the SPEC function properly controlled and accounted for Volunteer
Program computers.
A.
Determined
whether guidelines outlining the responsibilities of the SPEC function’s
control and accountability of Volunteer Program computers have been developed
and are clear and effective.
B.
Interviewed SPEC function management to
determine its responsibilities.
C.
Requested a STARS and ITAMS extract from the Modernization
and Information Technology Services.
D.
Validated the reliability of the STARS[18] and ITAMS[19] data by comparing the two extracts to
determine whether there were any discrepancies, tracing and verifying the data from
the samples reflected in Steps I.E. and II.C., accessing the STARS and comparing
the data, and receiving and comparing ITAMS screen prints from the Computer Depot[20] to the extracts.
E.
From the STARS extract, we selected a statistically
valid sample of 50 computers from a population of 1,815 computers reflected as
“in use.” We used a confidence interval
of 95 percent, a precision level of ±5 percent, and an expected error rate of 5 percent. We determined the persons assigned the
computers, contacted the individuals to determine whether they had possession
of the computers and, if so, obtained the barcodes and serial numbers of the
computers in their possessions. We
matched this information to our sample of inventory records to confirm the
accuracy. We also determined whether the
computers were correctly controlled on the ITAMS.
F.
Determined whether the Computer Depot shipped
defective computers to Volunteer Program sites by using the statistically valid
sample in Step I.C. We notified the
person assigned the computer and determined the quality of the computer.
G.
Determined whether procedures are being
followed when disposing of computers by obtaining the case files for lost or
stolen computers.
II.
Determined
whether computers are properly controlled by the End User Equipment and Services
function Computer Depot.
A.
Determined
whether guidelines outlining the responsibilities of the End User Equipment and
Services function Computer Depot control and accountability of Volunteer
Program computers have been developed and are clear and effective.
B.
Interviewed Computer Depot management and
obtained and reviewed Computer Depot’s guidelines to determine whether
procedures for controlling and accounting for Volunteer Program computers are
adequate.
C.
From the STARS, selected a statistically
valid sample of 51 computers from a population of 10,333 computers that were
physically located at the Computer Depot.
We used a confidence interval of 95 percent, a precision level of ±5 percent, and an expected error rate of 5
percent. We determined whether the
computers could be located and whether taxpayer data were found on the
computers. We also determined whether
the computers were correctly controlled on the ITAMS.
Internal controls
methodology
Internal controls relate to management’s plans, methods, and procedures used to meet their mission, goals, and objectives. Internal controls include the processes and procedures for planning, organizing, directing, and controlling program operations. They include the systems for measuring, reporting, and monitoring program performance. We determined the following internal controls were relevant to our audit objective: the IRS’ policies, procedures, and practices for controlling Volunteer Program computers. We evaluated these controls by interviewing management, reviewing extracts, validating computer locations, and reviewing case files.
Appendix II
Major Contributors to This Report
Michael E. McKenney, Assistant Inspector General for Audit (Returns
Processing and Account Services)
Augusta
R. Cook, Director
Roberta
Fuller, Lead Auditor
Jerome
Antoine, Auditor
Kathy
Coote, Auditor
Nelva
Usher, Auditor
Appendix III
Commissioner C
Office of the Commissioner – Attn: Chief of Staff C
Deputy Commissioner for Services and Enforcement SE
Deputy Commissioner, Wage and Investment Division SE:W
Director, Customer Account Services, Wage and Investment Division SE:W:CAS
Director, Customer Assistance, Relationships, and Education, Wage and Investment Division SE:W:CAR
Director, Strategy and Finance, Wage and
Investment Division SE:W:S
Associate CIO,
End-User Equipment and Services
OS:CTO:EU
Senior
Operations Advisor, Wage and Investment Division SE:W:ETARC
Chief Counsel CC
National Taxpayer Advocate TA
Director, Office of Legislative Affairs CL:LA
Director, Office of Program Evaluation and Risk Analysis RAS:O
Office of Internal Control OS:CFO:CPIC:IC
Audit
Liaison: Chief, Program Evaluation and
Improvement, Wage and Investment Division SE:W:S:PRA:
Appendix IV
Managing and Controlling Volunteer Program Computers
All Volunteer Program computers are tracked and controlled on the ITAMS[21] and the STARS.[22] Managers and partners/volunteers have responsibilities for maintaining and accounting for computers. The following are steps that are required in tracking, maintaining, processing, and shipping Volunteer Program computers.
Computer Depot[23] Responsibilities
A Single Point Inventory Function updates the ITAMS (required within 10 days) when computers are transferred between local and field offices.
Shipping
1) Laptops are pulled from inventory by first in, first out.
2) Laptops are imaged, encrypted, and barcodes are scanned.
3) Laptops are cleaned by:
a. Removing stickers.
b. Performing system checks.
c. Checking battery levels.
d. Inputting to the ITAMS.
e. Verifying serial numbers and barcodes.
4) Laptops are placed in computer bags, packaged, and stored until shipped out to the volunteers.
5) Computers are packaged with all peripherals and sent to the partner or volunteer.
Inventory
Reconciliation
1) Inventory reconciliation occurs annually by June 30, during the recurring inventory cycle.
2) Laptops are reconciled by matching information gathered at the time of the inventory with that recorded in the ITAMS and can be done using a barcode scanner or through manual touch.
3) Annually, after June 30, each office is sent a Reconciliation Plan along with a Certification letter that also includes the results from the analysis of the ITAMS.
4) Outstanding errors found during the analysis have to be resolved by the end of the fiscal year.
5) Lost or missing computers must have a Report of Survey (Form 1933) prepared.
Volunteer Responsibilities
The volunteers or partners have responsibilities in accounting for and verifying the receipt of laptops.
Receipt of Laptops
1) Verify that the equipment received matches the packing list.
2) Sign and return the packing list to the Computer Depot within 20 days of receipt.
3)
Verify the receipt of the laptop and mail the
Property Loan Agreement to the SPEC function within 20 days.
4)
Charge the laptop
battery for 24 hours before using the computer.
Returning the
Laptops
1)
Delete (wipe) data from
the laptop’s hard drive before returning it.
2)
Ship the laptop, using the same shipping box and packing
materials the laptop was received in, to the Computer Depot by May 15.
SPEC Function Responsibilities
There are three areas within the SPEC function that are involved in the loan of computers to the Volunteer Program sites.
SPEC Headquarters
1) Coordinates with the Computer Depot to share SPEC function needs and answers any questions the Computer Depot employees have.
2) Provides guidance for equipment orders, return of equipment, and STARS equipment maintenance with the Area.[24]
3) Places all equipment orders with the Computer Depot in a mutually agreed format.
4) Provides information to the Area analysts relating to the Computer Depot, equipment, annual inventory actions, orders, problems, etc.
5) Communicates changes/corrections needed in the STARS to the Area.
6) Facilitates any changes to the STARS concerning equipment at the Computer Depot.
7)
Ensures publications, forms, and documents
related to the Volunteer Program computers are updated as needed.
SPEC Area
1) Ensures the Territory offices complete computer orders and notify SPEC headquarters analysts of any anomalies with orders and/or shipments made to the Territory or partner.
2) Communicates between SPEC Headquarters and the Territory.
3) Ensures the Territory, Area, and SPEC Headquarters is informed of concerns relating to the Computer Depot, equipment, annual inventory actions, orders, etc. and any problems raised by the partners/volunteers relating to the equipment, orders, use, etc.
4)
5) Ensures Territories respond to SPEC Headquarter and Area requests for action.
6) Ensures Territories complete annual equipment certification actions.
7) Shifts equipment among its territories to ensure the greatest return on investment[25] while balancing service coverage. This includes ensuring equipment is used only for its intended purpose.
1) Determines the technology needs of its partners.
2) Works with the Area Office to obtain additional resources when needed.
3) Ensures equipment is used at an optimum level to balance with return on investment and service coverage.
4) Ensures that Volunteer Income Tax Assistance/Tax Counseling for the Elderly equipment is used only for the Volunteer Program.
5) Places all equipment orders as requested by the partners.
6) Confirms order information and delivery with partners/volunteers to ensure accurate delivery.
7) Secures Statement of Assurance Concerning Civil Rights Compliance for Internal Revenue Service SPEC Partnerships (Form 13325) or the Internal Revenue Service Civil Rights Assurance for Sub-recipients under SPEC Partnership Agreements (Form 13324) prior to delivery of the equipment.
8) Ensures the STARS correctly reflects contact information to ensure accurate completion of documentation of shipments by the Computer Depot.
9) Ensures the STARS correctly reflects the location of equipment at all times.
10) Communicates important information relating to the use of the equipment to partners/volunteers, such as passwords, use of equipment, etc.
11) Responds promptly to Area/Headquarter questions or concerns relating to the equipment.
12) Secures the Property Loan Agreement on loaned equipment and provides it to the Computer Depot in accordance with Annual Certification procedures.
13) Reports, secures, and maintains documentation on lost and/or stolen equipment.
14) Conducts site visits and reviews.
15) Apprises Area analysts of any problems relating to the equipment, orders, inventory, use, etc.
Appendix V
Procedures for Reporting and Documenting Lost or Stolen Computers
To ensure
proper reporting of lost or stolen IRS equipment, the IRS Relationship Manager gathers
as much information as possible about the lost or stolen equipment from the
initial contact with the Volunteer Program participant. A Checklist for Stolen Equipment (Form 13747)
[26] is used to
document the theft. It requires that the
Relationship Manager:
1)
Immediately
notify the local Territory[27] manager and report
the theft within 1 hour of
notification to the Computer Security Incident Response Capability office.
2)
Contact the TIGTA
Office of Investigations.
3)
Contact Customer
Assistance, Relationships, and Education function and SPEC function management.
4)
Contact the Volunteer Program Computer Depot.[28]
5)
If tax return
information was present, determine the need to notify the impacted
taxpayers.
6)
Determine
location of the IRS equipment when it was stolen and record barcode, serial
number, manufacturer, and model.
7)
If
equipment has been stolen more than once, determine if equipment will continue
to be loaned to the partner.
8)
Report to
the police and request a copy of the local police report.
9)
Attach a
copy of the Property Loan Agreement to an assessment memorandum.
10)
Update the STARS to reflect the theft of
the equipment.
11) Upon receipt in headquarters, review the package for completeness and share it with the Chief, Oversight and Analysis, and the Director, Field Operations. The documentation package is mailed to the Computer Depot.
12) The Computer Depot employee should complete a Report of Survey (Form 1933) and follow the appropriate steps to remove the computer from the ITAMS.
Appendix VI
Management’s
Response to the Draft Report
DEPARTMENT OF THE TREASURY
INTERNAL REVENUE SERVICE
CHIEF TECHNOLOGY OFFICER
April 21 2010
MEMORANDUM FOR DEPUTY
INSPECTOR GENERAL FOR AUDIT
FROM: Terence
V. Milholland /s/ Terence V. Milholland
Chief Technology Officer
SUBJECT: Draft
Audit Report – Accountability Over Volunteer Program computers Has
Significantly Improved, but Providing Computers to Volunteers Presents Many
Challenges (Audit # 200940046) (i-trak #2010-74082)
Thank you for the opportunity to review and respond to the
subject audit report. We appreciate your
comments and observations. The IRS
continues to strive to ensure that taxpayer data are safe and secure. The IRS has taken actions and addressed
concerns by certifying the Volunteer Program computer inventory beginning in
Fiscal Year 2006, developing guidelines outlining responsibilities of the
Stakeholder Partnerships, education and Communication (SPEC) and the End User
Equipment and Services (EUES) functions, and monitoring and limiting the ability
to change the Information Technology asset Management System (ITAMS) name data
field.
We disagree with the report’s statement “as a result of not
following procedure and having inadequate documentation, there is still a risk
that taxpayer data are not entirely safe and secure”. We agree that there is still a need to
continue to refine, update and follow the established procedures for reporting
lost and recovered computers; however, Volunteer Program computers are all
encrypted which creates a “brick” against unwanted or illegal entry. As discussed previously, we are again
requesting that this statement be removed from the report.
We acknowledge that our continued diligence is necessary in
this effort. We agree with the two
recommendations made as a result of your audit and the attachment to this memo
details our planned actions to implement them.
Your continued support and the assistance and guidance your
team provides have been a valuable resource to our organization. If you have any questions, please contact me
at (202) 622-6800 or Darrin D. Brown, Director, Program Oversight, at
(202)2883-4613.
Attachment
Attachment
RECOMMENDATION#1: The Chief Technology Officer should implement
a process to ensure law enforcement agencies are notified when a stolen
computer is recovered.
IMPLEMENTATION
DATE: May 15, 2010
RESPONSIBLE
OFFICIAL: Director, Stakeholder,
Partnerships, Education and Communication, Wage and Investment Division
CORRECTIVE ACTION
MONITORING PLAN: We enter
accepted Corrective Actions into the Joint Audit Management Enterprise System
(JAMES) and monitor them on a monthly basis until completion.
[1] Accountability Over Volunteer Income Tax Assistance Program Computers Continues to Be a Problem (Reference Number 2006-40-172, dated September 25, 2006).
[2] Some community-based Volunteer Program sites are located in buildings occupied by one or more IRS offices.
[3] The filing season is the period from January through mid-April when most individual income tax returns are filed.
[4] Computers Used to Provide Free Tax Help and That Contain Taxpayer Information Cannot Be Accounted For (Reference Number 2002-40-144, dated August 13, 2002) and Accountability Over Volunteer Income Tax Assistance Program Computers Continues to Be a Problem (Reference Number 2006-40-172, dated September 25, 2006).
[5] The ITAMS is the IRS’ authoritative record for asset control, where each piece of equipment is tracked from procurement to disposal.
[6] The data processing arm of the IRS. The campuses process paper and electronic submissions, correct errors, and forward data to the Computing Centers for analysis and posting to taxpayer accounts.
[7] A centralized location that receives computers for the Volunteer Program, prepares them for use by loading the operating system and tax preparation software, ships them to volunteers, and stores them when they are not in use.
[8] Two statistically valid samples of 51 and 50 computers were selected. Three tests were conducted on these 101 computers. See Appendix I for details of the selection methodology.
[9] The IRS partners with various organizations—corporate, faith-based, non-profit, educational, financial, and government—to combine resources and goals to assist taxpayers in satisfying their tax responsibilities.
[10] See Appendix IV for lists of actions taken to control Volunteer Program computers.
[11] Quality of Services at Volunteer Program Sites During the 2010 Filing Season – Followup (Audit # 201040018).
[12] The SPEC function is divided geographically into 4 Areas and 37 Territories.
[14] See Appendix V for details of the required procedures.
[15] Accountability Over Volunteer Income Tax Assistance Program Computers Continues to Be a Problem (Reference Number 2006-40-172, dated September 25, 2006).
[16] Pub. L. No. 81-152, 63 Stat. 377 (codified as amended in scattered sections of 40 U.S.C. and 41 U.S.C.).
[17] AARP computer requirements are processed through SPEC function Headquarters, whereas non-AARP computer requirements are processed through the Territory.
[18] The SPEC function’s computer system that is used to control Volunteer Program computers.
[19] The IRS’ authoritative record for asset control, where each piece of equipment is tracked from procurement to disposal.
[20] A centralized location that receives computers for the Volunteer Program, prepares them for use by loading the operating system and tax preparation software, ships them to volunteers, and stores them when they are not in use.
[21] The IRS’ authoritative record for asset control, where each piece of equipment is tracked from procurement to disposal.
[22] The SPEC function’s computer system that is used to control Volunteer Program computers.
[23] A centralized location that receives computers for the Volunteer Program, prepares them for use by loading the operating system and tax preparation software, ships them to volunteers, and stores them when they are not in use.
[24] The SPEC function is divided geographically into 4 Areas and 37 Territories.
[25] The net profit or loss in an accounting period divided by the capital investment used during the period, usually expressed as an annual percentage return.
[26] The reverse of the form is completed for lost equipment.
[27] The SPEC function is divided geographically into 4 Areas and 37 Territories.
[28] A centralized location that receives computers for the Volunteer Program, prepares them for use by loading the operating system and tax preparation software, ships them to volunteers, and stores them when they are not in use.