Plans for the Implementation of Merchant Card Reporting Could
Result in Burden for Taxpayers and Problems for the Internal Revenue Service
July 26, 2011
Reference Number: 2011-40-065
This report has cleared the Treasury Inspector General for Tax Administration disclosure review process and information determined to be restricted from public release has been redacted from this document.
Phone
Number | 202-622-6500
Email Address | TIGTACommunications@tigta.treas.gov
Web Site |
http://www.tigta.gov
HIGHLIGHTS
Plans FOR THE Implementation
OF Merchant Card Reporting COULD RESULT IN BURDEN FOR TAXPAYERS AND Problems
for THE INTERNAL REVENUE SERVICE
Highlights
Final
Report issued on July 26, 2011
Highlights of Reference Number:
2011-40-065 to the Internal Revenue Service Deputy Commissioner for
Services and Enforcement.
IMPACT ON TAXPAYERS
The
merchant card reporting section of the Housing and Economic Recovery Act of
2008 was designed to assist the Internal Revenue Service (IRS) in matching
income from sales paid with credit or debit cards to income claimed on a tax
return. This is an effort to reduce the Tax
Gap.
WHY TIGTA DID THE AUDIT
This
review was initiated to determine whether the IRS has a complete and detailed
plan in place to control and schedule the implementation of the merchant card
reporting law as intended by Congress.
The new law will add millions of additional information reporting
documents to the IRS computer systems.
WHAT TIGTA FOUND
The new
law requires payment settlement entities to report merchant card and
third-party payments to the IRS on Merchant Card and Third Party Network
Payments (Form 1099-K).
One of
the stated goals of merchant card reporting is to assist the IRS in matching
income from sales to income reported on
tax returns. TIGTA found that the IRS’s redesigning
of Tax Year 2011 income tax forms may not facilitate a direct match
between sales reported on Forms 1099-K and amounts reported on tax returns. Based on our finding, the IRS immediately
made adjustments to one tax form and is reviewing the other affected forms to
make similar improvements.
The law
requires payment settlement entities to withhold a percentage of gross receipts
(backup withholding) on those merchants who do not ultimately provide a valid Taxpayer
Identification Number and name that match IRS records. Because of the increased volume of Forms
1099-K resulting from merchant card reporting requirements, there is a risk
that mismatches might not be resolved before backup withholding becomes
mandatory. The IRS’s risk assessment and
implementation plan did not contain adequate details regarding these risks as
well as appropriate contingencies. TIGTA
also found that the risk assessment and implementation plan prepared by the IRS
lacked other details.
Finally,
the IRS did not properly account for funds appropriated for merchant card
reporting during the project’s initial stages.
WHAT TIGTA RECOMMENDED
TIGTA
recommended that the IRS monitor the amounts reported for merchant card and
third-party payments to ensure there is no confusion about where to enter the
amounts, the risk assessment and implementation plan adequately address
mismatching names and Taxpayer Identification Numbers, sufficient detail is
added to future risk assessments to address the full scope of the project, and future
implementation plans indicate the full scope of the project and expected due
dates. TIGTA also recommended that the
IRS ensure financial reporting is added to the risk assessment and
implementation plan so costs and schedules are tracked
and reported timely, and costs are accumulated when resources are first
used.
In
their response to the report, IRS officials agreed with the recommendations and
are planning appropriate corrective actions.
July 26, 2011
MEMORANDUM FOR Deputy Commissioner for Services and
Enforcement
FROM: Michael R. Phillips /s/ Michael R. Phillips
Deputy Inspector General for Audit
SUBJECT: Final Audit Report – Plans for the Implementation of Merchant Card Reporting Could Result in Burden for Taxpayers and Problems for the Internal Revenue Service (Audit # 201040028)
This report presents the results of our review to determine
whether the Internal Revenue Service has a complete and detailed plan in place
to control and schedule the implementation of the merchant card reporting law
as intended by Congress. This audit is
included in our Fiscal Year 2011 Annual Audit Plan and addresses the major
management challenge facing the Internal Revenue Service of Implementing Health
Care and Other Tax Law Changes.
Management’s complete response to the draft report is
included in Appendix IV.
Copies of this report are also being sent to the Internal Revenue Service managers affected by the report recommendations. Please contact me at (202) 622-6510 if you have questions or Michael E. McKenney, Assistant Inspector General for Audit (Returns Processing and Account Services), at (202) 622-5916.
A
Multidimensional Team Is Planning the Implementation
Financial
Reporting Was Not Addressed When Expenditures Began to Be Incurred
Appendices
Appendix
I – Detailed Objective, Scope, and Methodology
Appendix
II – Major Contributors to This Report
Appendix
III – Report Distribution List
Appendix
IV – Management’s Response to the Draft Report
Abbreviations
|
FY |
Fiscal Year |
|
GAO |
Government Accountability Office |
|
IRDM |
Information Reporting and Document
Matching |
|
IRS |
Internal Revenue Service |
|
MITS |
Modernization and Information
Technology Services |
|
TIN |
Taxpayer Identification Number |
Section 3091 of the
Housing and Economic Recovery Act of 2008[1] added Section 6050W to Title 26 of the
United States Code (hereafter referred to as merchant card reporting), which
requires payment settlement entities[2] to report payments made to merchants in
settlement of payment card[3] transactions. The reports of total gross receipts paid
to each merchant are to be sent to the Internal
Revenue Service (IRS) by February 28 (March 31 if filing electronically)
of each year, with the first reporting due in Calendar Year 2012. This reporting is expected to assist the IRS in matching income
from sales to income reported on tax returns in an effort to reduce the Tax
Gap.[4]
The law also requires
payment settlement entities to withhold a percentage of gross receipts (backup
withholding) on those merchants who do not ultimately provide a valid Taxpayer Identification
Number (TIN) and name that matches to IRS records. If the payment settlement entities do not
withhold the percentage amount when required, they are then held responsible
for the amount due. The law is effective
for tax returns with calendar years beginning after December 31, 2010. The backup withholding of 28 percent is
applicable to amounts paid after December 31, 2011. Third-party network businesses[5]
are required to report only if for the calendar year: 1) the aggregate reportable payment
transactions exceed $20,000, and 2) the aggregate number of these transactions
exceeds 200.
The House Committee on Small Business held a hearing on June 12, 2008,
on the proposed reporting requirement that later became part of Public Law 110-289. Interested parties submitted testimony and
expressed opinions on the effect the proposed legislation would have on small
businesses and payment settlement entities.
Some had serious concerns about privacy and data security. Others believed the negligible effect this
legislation would have on the Tax Gap would not justify the significant burden
placed on small businesses. One payment
settlement entity voiced concerns about the cost of compliance and the backup
withholding. After the legislation became
law on July 30, 2008, the IRS issued proposed regulations on November 23, 2009,
and requested comments by January 25, 2010, for a subsequent public
hearing. The hearing was held on March
15, 2010. The IRS issued final
regulations on August 16, 2010, and later issued a draft form to be used for
the reporting.
The reporting requirements of Section
6050W are not entirely new to the
IRS. The IRS routinely uses information
documents to verify income items on individual income tax returns and has done
so for many years.
The Department of the Treasury estimated this new law would result in
the additional collection of almost $10 billion over 10 years. A letter dated April 3, 2007, was presented
to the Committee on Ways and Means, Subcommittee on Oversight, which
commented on the various estimates of additional income this law was to
generate. The letter stated that, “The
uncertainty over the benefits of this reporting requirement is most evident in
the Federal budget proposals from FY [Fiscal Year] 2007 and FY 2008. In the FY 2007 report, the Treasury estimated
that the reporting requirement would help generate $9 million in 2007, $92
million during the years 2007–2011,
and $225 million during the years 2007–2016. In contrast,
the FY 2008 report stated that the reporting requirement would help generate
$113 million in 2008, $3.3 billion during the years 2008–2012, and $10.8 billion during the years 2008–2017. Both the FY 2007 and FY 2008 reports are
based on data gathered from the 2001 tax year, and there is no explanation for
how the proposed revenue estimate jumped astronomically from 2007 to 2008.”[6] While
the Department of the Treasury made its own estimate of the benefits of this law,
the IRS currently does not have a completed estimate of how much it expects to
collect.
This review was performed at the
IRS National Headquarters in Washington, D.C., with the IRS Small Business/Self-Employed Division taking
the role of liaison and forwarding requests to the proper offices throughout
the IRS. The audit was conducted during
the period January 2010 through January 2011.
We initiated this review
prior to all phases of the implementation being completed. We conducted
this performance audit in accordance with generally accepted government
auditing standards. Those standards
require that we plan and perform the audit to obtain sufficient, appropriate
evidence to provide a reasonable basis for our findings and conclusions based
on our audit objective. We believe that
the evidence obtained provides a reasonable basis for our findings and
conclusions based on our audit objective.
Detailed information on our audit objective, scope, and methodology is
presented in Appendix I. Major contributors
to the report are listed in Appendix II.
A Multidimensional Team Is Planning the Implementation
The IRS has a multidimensional team to plan and implement merchant card reporting. The team consists of executive level management, project management, and program office liaisons to interact with the various functions of the IRS affected by this law.
Team meetings are held at least monthly to discuss progress,
issues, and solutions that have developed and additional schedule items. A list of working assumptions was put
together early in the process, a high-level risk management plan addressing
three separate laws was put together and has been updated, and an action plan
has been developed. A list of the forms
that need to be revised and the new data lines that need to be put into IRS
computer systems for the new reporting requirement have been initiated. The IRS is
implementing merchant card reporting and taking subsequent actions necessary to
make use of the data and implement other newly passed laws that have similar
reporting requirements. Overall, the IRS
has the structure in place to implement this legislative provision. However, we do have some concerns.
Further Changes to Tax Forms May Be Required to Facilitate Matching Merchant Card Receipts With Amounts Reported on Tax Returns
The new law requires payment settlement
entities to report merchant card and third-party network payments to the IRS on
Merchant Card and Third Party Network Payments (Form 1099-K). Based on our review of the regulations issued
by the IRS, the payments reported on Form 1099-K may include cash back. For example, when a customer makes a
purchase, pays for the purchase with a debit or credit card, and requests cash
back from the merchant, the entire amount of the transaction, including the
cash back, would be included on Form 1099-K as a merchant card purchase. However, the amount of cash back received by
the customer is not income to the merchant.
The IRS is in the process of redesigning the
Tax Year 2011 income tax forms and the corresponding instructions to
accommodate the reporting of these merchant card and third-party payments. One of the stated goals of the merchant card
reporting legislation is to assist the IRS in matching income from sales to
income reported on tax returns to reduce the Tax Gap. In our opinion, this matching will only be
efficient and effective if reporting documents and tax returns are designed to
facilitate a direct match between the two sources.
We are concerned the proposed redesign of
some tax forms will not facilitate such a match. The forms involved include the following:
·
U.S.
Return of Partnership Income (Form 1065).
·
U.S.
Corporation Income Tax Return (Form 1120).
·
U.S.
Income Tax Return for an S Corporation (Form 1120S).
·
Profit
or Loss From Business (Schedule C – U.S. Individual Income Tax Return (Form 1040)).
Figure 1 shows the new Form 1099-K. Figure 2 describes how income on Schedule C
is currently calculated. Figure 3
describes the IRS’s planned redesign of Schedule C at the time of our review.
Figure 1: Proposed Form for
Merchant Card and Third-Party Network Payments
Figure 1 was removed due to its size. To see Figure 1, please go to the Adobe PDF
version of the report on the TIGTA Public Web Page.
Figure 2: Lines 1–5 From 2010 Schedule C
|
Part
I - Income |
|
|
1
Gross receipts or sales |
$ |
|
2
Returns and allowances |
$ |
|
3
Subtract line 2 from line 1 |
$ |
|
4
Cost of goods sold |
$ |
|
5
Gross
profit. Subtract line 4 from line 3 |
$ |
Source: Profit
or Loss From Business Schedule C (2010).
Figure 3: Income Lines From
Redesigned 2011 Schedule C
|
Part
I - Income |
|
|
1a Merchant card and third-party payments
received |
$ |
|
1b Gross receipts or sales not reported on line
1a |
$ |
|
1c Income reported to you on Form W-2
(Statutory Employees) |
$ |
|
1d Total Gross Receipts |
$ |
|
2 Returns and allowances[7] |
$ |
|
3 Subtract line 2 from line 1d |
$ |
|
4 Cost of goods sold |
$ |
|
5 Gross profit. Subtract line 4 from line 3 |
$ |
Source: Redesigned
Schedule C (2011) provided by the IRS.
Form 1065, Form 1120, and Form 1120S are
similarly designed. As designed at the
time of our review, taxpayers and tax preparers were to be told in the
instructions to include “cash back” on line 2, “returns and allowances.”[8]
Returns and allowances has long been defined as a contra revenue account that reports: 1) merchandise returned by a customer and 2) allowances granted to a customer for prompt payment or because the seller shipped improper or defective merchandise. We are concerned that rather than including cash back in returns and allowances, taxpayers and preparers will either neglect to reduce their gross profits by the amount of cash back provided to their customers or they will report their merchant card and third-party payments on line 1a net of the cash back amounts.
The Treasury Inspector General for Tax Administration
presented another option for the IRS to consider, which would include specific
line items on the tax returns for both merchant card sales and cash back
amounts, as described in Figure 4.
Figure
4: Additional Option for Redesigned 2011
Schedule C
|
Part I - Income |
|
|
|
1
Gross cash sales |
|
$ |
|
2a Gross merchant card sales |
$ |
|
|
2b Less cash back |
$ |
|
|
2c Net merchant card sales |
|
$ |
|
3 Total Gross Receipts |
|
$ |
|
4 Returns and allowances |
$ |
|
|
5 Subtract line 4 from line 3 |
|
$ |
|
6 Cost of goods sold |
$ |
|
|
7 Gross Profit. Subtract line 6 from line 5 |
|
$ |
Source: Treasury Inspector General for Tax
Administration Redesigned Schedule C (2011).
The IRS took
immediate corrective action to address our concerns regarding Schedule C (see
footnote 7) and is looking at the other forms affected (Schedules E and F (Form
1040) and Forms 1065, 1120, and 1120S) to make similar improvements to the
forms and schedules and their corresponding instructions.
Misreporting cash
back may result in a mismatch when the IRS compares gross receipts from
merchant card payments as reported on the tax return with amounts on Form
1099-K. These mismatched amounts may
cause the IRS to contact the taxpayer for an explanation, increasing the burden
on both the taxpayer and the IRS.
Recommendation
Recommendation 1: The Commissioner, Small Business/Self-Employed Division, should ensure that changes similar to those drafted for Schedule C are made to Schedules E and F (Form 1040) and Forms 1065, 1120, and 1120S to confirm that there is no confusion about where to enter cash back on the income tax return to arrive at taxable income and that the amounts entered on the tax return can be matched with amounts on Form 1099-K. The IRS should monitor the ‘merchant card and third-party network payments’ amounts that taxpayers enter on their income tax return to ensure that taxpayers and preparers understand how to properly report gross receipts and cash back amounts. If warranted, the income tax returns should be changed to include a specific line for cash back.
Management’s
Response:
IRS management has revised Schedule C (Form 1040) and will
revise Forms 1065, 1120, and 1120S to inform taxpayers where to enter cash back
on the return. Since cash back
transactions for Schedules E and F (Form 1040) filers are infrequent, the IRS
will include the information in the instructions for these forms.
IRS
management will monitor the amounts reported for merchant card and third-party
payments and communicate to taxpayers and practitioners challenges identified
in the filing of the new Form 1099-K.
Steps Were Taken to Reduce
Mismatches of Taxpayer Identification Numbers and Names on Information
Documents, but the Risk of Backup Withholding Caused by Mismatched Documents
Still Exists
In discussions with Treasury Inspector General for Tax Administration auditors, the IRS indicated it intends to validate the TINs and names of taxpayers shown on Forms 1099-K as the documents are received. However, as of the date of our review, the IRS’s risk assessment and implementation plan did not contain adequate details regarding the risks associated with any inability to perform these validations and the resulting initiation of backup withholding, as well as appropriate contingencies.
The IRS does provide access to a system called the E-Services On-Line TIN Matching Program that can be used to verify the merchant name and TIN in advance of filing Forms 1099-K. This should help resolve issues before they occur. In addition, the IRS has a system in place to validate the TINs on the information documents when they are filed with the IRS. This validation takes place in May of each year and at other times throughout the year.
The IRS initially estimated 125 million Forms 1099-K would be issued for merchant card reporting. That estimate was recently reduced to approximately 54 million. Based on the IRS’s historical information regarding the prefiling rate of unmatched TINs and names on information documents, resolving the mismatches may take significant resources for the IRS, payment settlement entities, and taxpayers.
The IRS’s computed prefiling rate of mismatched records from its E-Services On-Line TIN Matching Program for 4 fiscal years is included in Figure 5.
Figure 5: Prefiling TIN Mismatch Rate
|
FY |
Percentage |
|
2006 |
10.4 |
|
2007 |
13.7 |
|
2008 |
26.3 |
|
2009 |
29.5 |
Source: IRS Electronic Products and Services Support
Office.
Historically, most mismatched TINs are resolved. The IRS reported that for 4 years (Tax Years 2006–2009), an average of only 1.78 percent of information documents received and processed through TIN validation had name and TIN mismatches. In addition, backup withholding requirements do not take effect until Calendar Year 2012 providing more time to resolve mismatches. However, as discussed above, millions more information documents are expected to be filed. If mismatches are not resolved, merchants and payment settlement entities will be burdened with backup withholding requirements.
Recommendation
Recommendation
2:
The Commissioner, Small Business/Self-Employed
Division, should ensure the risk assessment and implementation plan adequately
address the issue of mismatched TINs and names and the initiation of backup
withholding.
Management’s
Response:
IRS management agreed with this recommendation. TIN Matching is an existing service offered
to certain Form 1099 filers. The IRS
submitted a Unified Work Request to add the Form 1099-K to the TIN Matching
System. To date, the number of
mismatches identified has been minimal and should not cause a burden of backup
withholding on taxpayers and filers. The
IRS is updating On-Line TIN Matching Program (Publication 2108A).
In addition, the
IRS has performed an impact assessment regarding Form 1099-K on backup
withholding. Integration of backup
withholding requirements into the existing backup withholding program has
commenced to ensure timely implementation of the provision for 2012.
Additional Details in the Risk Assessment and Implementation Plan Could Increase the Chance of Successful Implementation
The IRS has developed a framework to identify certain risks and steps needed to implement the intent of the merchant card reporting legislation. However, as of the date of our review, we found some significant issues were not adequately documented in the IRS’s plans. We believe additional steps will facilitate a more successful and timely implementation. The IRS has combined three different pieces of legislation into a single program known as the Information Reporting and Document Matching (IRDM) program. The implementation of the merchant card reporting legislation is included in the IRDM program. The IRDM program is intended to allow the IRS to develop a system that will encompass more than one activity. With the magnitude of implementing three different pieces of legislation into one program, it is important that all significant risks and implementation steps be considered and documented.
The risk assessment did not address several significant risks
To successfully deliver a project of this magnitude, managers must thoroughly analyze and quantify risk before and during the project, as well as develop effective response strategies to deliver projects that meet the demands of stakeholders such as Congress and taxpayers. Risk in this case is defined as an uncertainty that can have a negative effect on meeting project objectives. Risk assessments need to address the potential for delay, disruption, or rework and address contingency plans as needed. In addition, a complete risk assessment should estimate the likelihood that a risk may occur.
The risk assessment should help identify specific risks and controls necessary to reduce or eliminate the risks. As of April 2010, the risk assessment prepared for the IRDM program for the three laws consists of:
Specific risks associated with the implementation of merchant card reporting were not documented in this risk assessment. The MITS organization, responsible for computer programs, prepared a Solution Concept document in February 2009 specific to merchant card reporting which contained some elements of a risk assessment, but this was for the MITS organization’s work only and indicates that not all affected interfaces were identified. It was also based on the initial concept of a single field added to Miscellaneous Income (Form 1099-MISC). The new Form 1099-K has added 12 additional fields for monthly totals.
Some of the risks specific to merchant card reporting that we believe should have been identified early and documented include:
· Programming may not be completed in order to use the data.
As discussed previously, the Tax Year 2011 income tax forms have not been redesigned and published to make use of the Form 1099-K information that will be sent to taxpayers and the IRS beginning in Calendar Year 2012. Programming must be completed to make use of the new income tax form designs and data fields before the system programming can be done to compare the tax return data to Form 1099-K data in IRS information document files. All of the programming must be tested prior to being put into a production mode to handle the data.
· Capacity of IRS systems may not be adequate to match TINs and names when the new documents are first received at the IRS requiring correspondence with the sender on any mismatches.
The July 2010 executive briefing for the IRDM program indicated that some of the systems are at capacity before all of the new information documents begin arriving. The IRS indicates it has ordered the equipment necessary to implement this law. The Affordable Care Act[10] has recently added additional information reporting requirements which may significantly increase this risk.
·
Sensitive taxpayer data could be at risk of
disclosure.
IRS guidance requires that every system with
Personally Identifiable Information[11] have a Privacy
Impact Assessment;[12] however, there is
no mention of security reviews in the risk assessment. Discussions with IRS personnel indicated that
existing systems with security in place were going to
be used, but a new system is scheduled to be built based on an existing
one. MITS did some risk assessments
based on existing systems and plans to do the security testing on the new
system. The IRS stated that it follows
detailed steps as required by law to ensure the security of sensitive taxpayer
data. However, we believe that because
of the significant risk associated with transmitting and storing large amounts
of sensitive data, the effect if the data are compromised, and the fact that
the IRS has been criticized in the past for security weaknesses, the IRS should
have specifically addressed this issue in its risk assessment to ensure all
necessary steps were taken and contingency plans were developed as necessary.
The Government Accountability Office (GAO) issued a report[13] in March 2009 that states, “Security weaknesses continue to affect IRS’s modernization environment. As GAO recently reported, IRS continues to have weaknesses in its information security controls. In addition, the Treasury Inspector General for Tax Administration reported that two tax administration systems were deployed with known security vulnerabilities relating to the protection of sensitive data, system access, monitoring of system access, and disaster recovery.”
The IRS indicated it plans an education program for the payers after the regulations are finalized, but these plans are not included in the implementation plan or risk assessment. When asked about security information being included in the education program, the IRS responded that most of the payers that will be submitting the forms are already dealing with the IRS and know about security and how to use the IRS systems. The IRS has no information at this time about the characteristics of all the payment settlement entities that will be involved with this new requirement. Since Personally Identifiable Information will be maintained by the payment settlement entities under the regulations, including information about security of taxpayer information in the educational materials would help these entities meet the requirements of regulations.
·
Payment settlement entities and merchants will
require significant education. In
addition, new forms and instructions must be developed. Failure to deliver these timely could
significantly affect the timeliness of the implementation of merchant card
reporting and businesses ability to meet the initial due date for reporting. Internal due dates are already being delayed;
however, the impact of this delay is not known at this time. Subsequent to our review period, the IRS
reported that it had completed a critical path analysis, and none of the
slippage should affect timely delivery of the project.
The IRS is currently updating its risk assessment monthly and relying on its internal procedures to handle issues after they develop. Without a timely, complete risk assessment, unforeseen circumstances could result in failure to implement the law as intended by Congress.
Recommendation
Recommendation
3:
The Commissioner, Small Business/Self-Employed
Division, should ensure the IRS adds sufficient detail to this and future risk
assessments to address the full scope of the project.
Management’s
Response: IRS management
agreed with this recommendation. The
program has a well documented risk assessment process that has been implemented
to include identification of risk mitigation and impact analysis. The risk assessment process ensures that all
risks and mitigation strategies are documented and approved by governance.
Detailed
Work Breakdown Structures have been developed that cover the full scope of the
program. In addition, risks covering the
full scope of the program as well as risks specific to the implementation of
merchant card reporting were documented and monitored on the governance risk
matrix.
Tax Year
2011 income tax forms have new lines to facilitate matching for the Form 1099-K.
The IRDM program’s implementation plans
include specific merchant card legislation requirements that support
line-to-line matching as well as testing of data at various phases.
The IRDM program
follows the IRS Enterprise Life Cycle.
Cybersecurity’s concurrence is required for each Enterprise Life Cycle
milestone exit. Cybersecurity performs a
Security Controls Assessment prior to the IRDM program beginning
operation. The Federal Information
Security Management Act[14] security controls are required to be in place to ensure
the protection of sensitive data. These
controls are tested and any risks are identified along with mitigations prior
to system production.
The implementation plan for
merchant card reporting is too general to be an effective management tool
One of the basic purposes of an implementation plan is to help management track, monitor, and evaluate the progress of a project or plan. The plan helps identify possible problems in advance, as they arise, because alternative solutions have already been considered. A plan document containing the major milestones and a schedule for the implementation is necessary in order to know if the project is on schedule and on budget. In the GAO report referred to earlier, the GAO reported on the IRS’s use of conditional milestones (whereby projects are allowed to continue with outstanding issues needing to be addressed) which were not supported by documented procedures and could potentially be used to mask cost and schedule overruns. The GAO recommended that the IRS have plans with specific time periods and develop quantitative measures to meet project scope expectations.
The IRDM program implementation plan for merchant card reporting was not specific enough. Although all major milestones should have been planned and scheduled at the beginning of the project, some key milestones were not documented in the plan available at the time of our review. For example, there was no mention of validating the merchants’ TINs when the Form 1099-K information document is originally received from the payment settlement entity. The IRS indicated it intends to validate the TINs as the documents are received. However, there is no indication in the plan of what will happen when names and TINs do not match data on IRS records. There is a requirement for backup withholding on the Form 1099-K if the merchant’s TIN is not correct, yet there is no indication in the plan of how this will be handled or if it was a consideration.
The IRS relies heavily on its computer systems to process tax returns and collect taxes. Yet the plan does not consider the security of the computer systems being planned and changed or the new data being received. The MITS organization responsible for the actual program development said that it will do a system security check even though this was not scheduled in the plan. The IRS continues to add details to its plan. In light of issues related to system security previously reported by the GAO,[15] we expected the IRS to have more detail of the security considerations in its plan.
Even though all items in the law have been addressed, we do not believe the IRS made plans in sufficient detail for merchant card reporting to be implemented in an efficient manner and with all major steps documented. A fully documented plan could assist the IRS in future planning and cost estimating as well as ensuring all important risks were considered and dealt with. Subsequent to our review, the IRS reported to the Treasury Inspector General for Tax Administration that it had added significant detail to its overall plan and strategy.
Recommendation
Recommendation 4: The Commissioner,
Small Business/Self-Employed Division, should ensure the IRS adds sufficient detail to this and future implementation
plans to indicate the full scope of the project and expected or estimated due
dates.
Management’s
Response:
IRS management agreed with this recommendation. Detailed Work Breakdown Structures have been developed that cover the full scope of the program,
including expected production delivery dates.
Financial Reporting Was Not Addressed When Expenditures Began to Be Incurred
Financial reporting needs to be considered and planned at the start of a project to properly track costs.
In order to successfully manage a project, management needs
financial and tracking reports on a regular basis to know if the project is on
schedule and within budget. In June
2010, the Office of Management and Budget issued a memorandum to the heads of
executive departments and agencies informing them that
in order to lower cost and improve government performance, the Federal Chief
Information Officer was beginning a review of the highest risk Information
Technology projects across the Federal Government. “Agencies
will be required to present improvement plans to the Chief Information Officer
for projects that are behind schedule or over budget. Where serious problems are identified and
cannot be corrected, further actions should be taken, including potential
adjustments to FY 2012 agency budgets. … The Director of the Office of
Management and Budget is directing executive departments and agencies to
refrain from awarding new task orders or contracts for financial system
modernization projects.”
The IRS has a document for budget management of the IRDM program that is dated February 26, 2010. The document indicates there is a project code that will allow the verification and control of IRDM program costs reported at the project level. After repeated requests for financial or tracking reports showing the expenditures and due dates of items for this project, the IRS has supplied some documentation to show that financial reporting is in place or has been considered in the IRDM program overall plan.
Approximately $8 million was allocated to merchant card reporting work from the IRS’s FY 2008 budget. The IRS could not provide an accounting of how these funds were used. The FY 2009 budget included $23 million to implement a number of legislative proposals, which included merchant card reporting but did not specify how much was for this law. The FY 2011 Congressional Budget Submission specifically requests $2.1 million and 19 new employees for the matching of the merchant payment card data to tax returns.
The MITS organization has indicated that it has allocated $22.5 million for the IRDM program for FY 2010, yet provided no explanation of the item due dates or scheduled delivery and did not specify the amount for merchant card reporting.
The Small Business/Self-Employed Division indicated that the implementation costs for merchant card reporting had been absorbed in normal operating costs from its passage through the latter part of Calendar Year 2010 because the expenditures were small. It now has begun utilizing the programs in place to identify implementation expenditures and review the related reports on a regular basis. These expenditures are identified by codes issued by the Chief Financial Officer. Since it was absorbing the costs, there were no examples of its financial reports at the time of our review. The MITS organization provided us with a copy of the online information that it had available for viewing its allocations and expenditures in total.
If the IRS does not accumulate costs when it first begins expending resources on a project, as in when preparing the risk assessment, it will not have good historical information on which to base future estimates of cost and times to accomplish tasks.
Recommendation
Recommendation 5: The Commissioner, Small Business/Self-Employed Division, should ensure that financial reporting is added to the risk assessment and implementation plan to help ensure the costs and schedules are tracked and reported timely. Accumulation of costs should begin when resources are first used on the project, as in preparing the risk assessment.
Management’s
Response:
IRS management agreed that financial reporting should be
tracked and monitored. IRDM program costs
are being tracked and monitored through an Exhibit 300. The monthly IRDM program reporting includes
monitoring of developed spending plans using Earned Value Management, where
costs and schedules, including explanations for variances, are reported and
assessed. In addition, through the
Earned Value Management reporting, the program reports monthly on all
accomplishments and risks to schedules and costs.
The Small
Business/Self-Employed Division has established written guidance for
individuals to charge costs when performing work in support of the IRDM
program. The Internal Order Code
Document Matching Tax Gap Initiative was established to capture these
costs. Reports are available in the
Integrated Financial System, which allows tracking of labor and nonlabor
costs. These reports are generated and
monitored on a biweekly basis.
Appendix I
Detailed Objective, Scope, and Methodology
Our overall objective was to
determine whether the IRS has a complete and detailed plan in place to control
and schedule the implementation of the merchant card reporting law as intended
by Congress. This involves new data (gross sales from Merchant Card and Third Party Network Payments (Form 1099-K)) being received for individual and
business units,[16] using the new data to check against tax return items
reported, collecting additional taxes as necessary, and tracking the costs of
this multibusiness unit program. We obtained the information for this audit by
interviewing the IRS teams responsible for the plan and accessing IRS
information on various IRS internal web sites. To achieve this overall objective, we:
I.
Determined if the IRS
has a plan to implement merchant card reporting.
A.
Obtained and analyzed
the IRS-prepared risk management plan to ensure:
1.
The IRS has addressed
all major risks.
2.
The steps have been
designed to address each major risk.
B.
Analyzed high-level
and detailed implementation schedules.
C.
Reviewed the IRS’s
implementation plan to ensure it addresses all of the issues in the law.
D.
Reviewed any
regulations regarding the new law to determine if the IRS has written the
regulations in accordance with the intent of Congress, based on any hearings
and committee reports.
E.
Interviewed Legislative Analysis, Tracking,
and Implementation Services personnel and
reviewed steps taken or still being considered to implement the law.
II.
Determined if the
implementation plan has addressed security issues.
A.
Discussed with IRS
personnel any security controls in place to ensure the IRS has the capacity and
systems to receive and secure all of the new data.
B.
Discussed with IRS
personnel the controls the IRS has requested to be in place for businesses that
are involved with collecting and then sending the new data to the IRS.
III.
Determined how the IRS
plans to make use of the new data.
A.
Discussed with IRS
personnel how the new data will be received and validated and how error records
will be handled.
B.
Discussed with IRS
personnel plans to establish the new Business Master File[17] underreporting database and procedures.
C.
Discussed with IRS
personnel how this new information will be incorporated and used in the
Individual Master File[18] underreporting process that is currently in place.
D.
Discussed with IRS
personnel how and when the backup withholding will post to the Master Files.[19]
E.
Verified if various divisions
within the IRS have different plans (i.e., the Tax Exempt and Government
Entities Division and the Large Business and International Division). We also determined if all the divisions make
use of an automated underreporter type of process.
F.
Reviewed the plan for
making use of the new data.
1.
Reviewed the
instructions for making the gross payment card and third-party network sales
dollars provided by the payment settlement entities (the ultimate organization
or entity responsible for making final payments to merchants and reporting
annually to the IRS on payment card and third-party network transactions) match
the business gross income as reported on a tax return. Items included were:
a.
Cash back amounts.
b.
Electronic checks.
c.
Pay Pal-type sales.
d.
Cell phone-type
payments.
2.
Reviewed the IRS’s
plans, if any, for ensuring the data received from the merchant providers are
accurate.
3.
Reviewed the training programs
being established for IRS employees learning how to make use of the new data.
G.
Reviewed any
documentation for writing and testing the logic on how the IRS will use the new
data.
H.
Analyzed the plans to
purchase and schedule any necessary additional resources in order to make use
of the new data.
I.
Analyzed the schedule
for using the additional resources in order to make use of the new data.
IV.
Determined if the IRS
can justify the numbers and income provided to Congress by the Department of
the Treasury.
A.
Analyzed the
supporting documentation used by the Department of the Treasury.
B.
Discussed with IRS
personnel if the figures provided by the Department of the Treasury are valid
and, if not, obtained the IRS’s figures along with supporting documentation.
V.
Determined if the
financial tracking system is in place for this project.
A.
Verified that specific
accounting codes were assigned for tracking costs on this project.
B.
Held discussions with
the IRS Chief Financial Officer’s office to determine if reports on the costs
and budgets for this project will be issued on a scheduled basis.
C.
Verified there are
controls in place to control/report cost overruns, who will be receiving these
reports, and what will be done to address any problems.
Internal controls methodology
Internal
controls relate to management’s plans, methods, and procedures used to meet
their mission, goals, and objectives.
Internal controls include the processes and procedures for planning,
organizing, directing, and controlling program operations. They include the systems for measuring,
reporting, and monitoring program performance.
We determined the following internal controls were relevant to our audit
objective: Chief Technology Officer, Small Business/Self-Employed Division, and Wage and Investment Division policies,
procedures, and practices for processing selected work streams in campus[20] operations.
We evaluated these controls by interviewing management and reviewing
applicable manuals.
Appendix II
Major Contributors to This Report
Michael E. McKenney, Assistant Inspector General for Audit (Returns
Processing and Account Services)
Kyle R. Andersen, Director
Richard J. Calderon, Audit Manager
Roy E. Thompson, Audit Manager
Glory Jampetero, Lead Auditor
W. George Burleigh, Senior Auditor
Appendix III
Commissioner C
Office of the Commissioner –
Attn: Chief of Staff C
Commissioner, Small
Business/Self-Employed Division SE:S
Commissioner, Wage and Investment
Division SE:W
Deputy Commissioner, Small
Business/Self-Employed Division SE:S
Deputy Commissioner, Wage and
Investment Division
SE:W
Chief Counsel CC
National Taxpayer Advocate TA
Director, Office of Legislative Affairs CL:LA
Director, Office of Program Evaluation and Risk Analysis RAS:O
Office of Internal Control OS:CFO:CPIC:IC
Chief Technology Officer OS:CTO
Audit Liaisons:
Chief, Program Evaluation and Improvement CL
Director, Communications, Liaison, and Disclosure SE:S:CLD
Chief, Program Evaluation and Improvement,
Wage and Investment Division
SE:W:S:PRA:PEI
Appendix IV
Management’s Response to the Draft Report
DEPARTMENT OF THE TREASURY
INTERNAL
REVENUE SERVICE
WASHINGTON,
D.C. 20224
Commissioner
Small
Business/Self-Employed Division
JUNE, 8 2011
MEMORANDUM
FOR MICHAEL R. PHILLIPS
DEPUTY INSPECTOR GENERAL FOR AUDIT
FROM: Faris R. Fink
/s/ Faris R. Fink
Commissioner, Small Business/Self-Employed
Division
SUBJECT: Draft Audit Report - Plans
for the Implementation of Merchant Card Reporting Could Result in Burden for
Taxpayers and Problems for the Internal Revenue Service (Audit # 201040028)
We have
reviewed your draft report, "Plans for the Implementation of Merchant Card
Reporting Could Result in Burden for Taxpayers and Problems for the Internal
Revenue Service." While we disagree with the characterization that
implementation plans could result in burdens for taxpayers and problems for the
Internal Revenue Service, we agree with the recommendations in the report and
are taking steps accordingly.
The
implementation of merchant card legislation should help to reduce the Tax Gap.
As the reporting of merchant card payments is a new requirement, we will
monitor the reporting for merchant card and third-party payments in our efforts
to simplify this new reporting requirement. We plan to communicate our findings
from the monitoring to taxpayers and practitioners. We also recognize the
importance of obtaining meaningful feedback from the public and, whenever
possible, will enhance forms and instructions to ensure accurate reporting.
Consistent
with TIGTA's recommendations, we have taken actions to improve our
implementation plans and the identification of key risks and corresponding
contingencies. We will continue to ensure sufficient details are added to
future risk assessments and future implementation plans include the full scope
of the project and incorporate expected due dates.
Finally,
appropriate financial controls have been put in place. We are now following
Earned Value Management (EVM) principles for the tracking and monitoring of
funding, including the monitoring of risks associated with financials. Attached
is a detailed response outlining our corrective actions.
If you have
any questions, please contact me, or a member of your staff may contact Samuel
F. Perdue, Director, Information Reporting and Document Matching at (336)
269-0757.
Attachment
Attachment
RECOMMENDATION
1:
The
Commissioner, Small Business/Self-Employed Division, should ensure that changes
similar to those drafted for Schedule C are made to Schedules E and F (Form
1040), and Forms 1065, 1120, and 1120S to confirm that there is no confusion
about where to enter cash back on the income tax return to arrive at taxable
income, and that the amounts entered on the tax return can be matched with
amounts on Form 1099-K. The IRS should monitor the 'merchant card and
third-party network payments' amounts that taxpayers enter on their income tax
returns to ensure that taxpayers and preparers understand how to properly
report gross receipts and cash back amounts. If warranted, the income tax
returns should be changed to include a specific line for cash back.
CORRECTIVE
ACTION(S):
IMPLEMENTATION
DATE(S):
RESPONSIBLE
OFFICIAL(S):
RECOMMENDATION
2:
The
Commissioner, Small Business/Self-Employed Division, should ensure the risk
assessment and implementation plan adequately address the issue of mismatched
TINs and names and the initiation of backup withholding.
CORRECTIVE
ACTION:
We agree with
this recommendation. Taxpayer Identification Number (TIN) Matching is an
existing service offered to certain 1099 filers. We submitted a Unified Work
Request to add the Form 1099-K to the TIN Matching System. To date, the number
of mismatches identified has been minimal and should not cause a burden of
backup withholding on taxpayers and filers. We are updating Publication 2108A,
On-Line Taxpayer Identification Number (TIN) Matching Program.
In addition,
we have performed an impact assessment regarding Form 1099-K on backup
withholding. Integration of backup withholding requirements into the existing
backup withholding program has commenced to ensure timely implementation of the
provisions for 2012.
IMPLEMENTATION
DATE:
Completed
RESPONSIBLE
OFFICIAL:
Director,
Information Reporting and Document Matching
RECOMMENDATION
3:
The
Commissioner, Small Business/Self-Employed Division, should ensure the IRS adds
sufficient detail to this and future risk assessments to address the full scope
of the project.
CORRECTIVE
ACTION:
We agree with
this recommendation. The program has a well documented risk assessment process
that has been implemented to include identification of risk mitigation and
impact analysis. The risk assessment process ensures that all risks and
mitigation strategies are documented and approved by governance.
Detailed Work
Breakdown Structures (WBS) have been developed that cover the full scope of the
program. In addition, risks covering the full scope of the program as well as
risks specific to the implementation of merchant card reporting were documented
and monitored on the governance risk matrix.
Tax Year 2011
income tax forms have new lines to facilitate matching for the Form 1099-K.
Information Reporting and Document Matching's (IRDM) implementation plans
include specific merchant card legislation requirements that support
line-to-line matching as well as testing of data at various phases.
IRDM follows
the IRS Enterprise Life Cycle (ELC). Cybersecurity's
concurrence is required for each ELC milestone exit. Cybersecurity
performs a Security Controls Assessment prior to IRDM beginning operation. The
Federal Information Security Management Act (FISMA) security controls are
required to be in place to ensure the protection of sensitive data. These
controls are tested and any risks are identified along with mitigations prior
to system production.
IMPLEMENTATION DATE:
Completed
RESPONSIBLE OFFICIAL:
Director,
Information Reporting and Document Matching
RECOMMENDATION 4:
The
Commissioner, Small Business/Self-Employed Division, should ensure the IRS adds
sufficient detail to this and future implementation plans to indicate the full
scope of the project and expected or estimated due dates.
CORRECTIVE ACTION:
We agree with
this recommendation. Detailed Work Breakdown Structures have been developed
that cover the full scope of the program, including expected production
delivery dates.
IMPLEMENTATION DATE:
Completed
RESPONSIBLE OFFICIAL:
Director,
Information Reporting and Document Matching
RECOMMENDATION 5:
The
Commissioner, Small Business/Self-Employed Division, should ensure the
financial reporting is added to the risk assessment and implementation plan to
help ensure the costs and schedules are tracked and reported timely.
Accumulation of costs should begin when resources are first used on the project,
as in preparing the risk assessment.
CORRECTIVE
ACTION:
We agree that
financial reporting should be tracked and monitored. IRDM costs are being
tracked and monitored through an Exhibit 300. The monthly IRDM reporting
includes monitoring of developed spending plans using EVM where costs and
schedules, including explanations for variances, are reported and assessed. In
addition, through the Earned Value Management (EVM) reporting, the program
reports monthly on all accomplishments and risks to schedules and costs.
SB/SE has
established written guidance for individuals to charge costs when performing
work in support of the IRDM program. The Internal Order Code Document Matching
Tax Gap Initiative (DMTGI) was established to capture these costs. Reports are
available in the Integrated Financial System, which allows tracking of labor
and non-labor costs. These reports are generated and monitored on a bi-weekly
basis.
IMPLEMENTATION
DATE:
Completed
RESPONSIBLE
OFFICIAL:
Director, Information Reporting and Document Matching
[1] Pub. L. No. 110-289, 122 Stat. 2654 (2008).
[2] “Payment settlement entity” as used in this document means the banks and other organizations with contractual obligations to make payment to participating payees (merchants) in settlement of payment cards, or third-party settlement organizations.
[3] Generally credit and debit cards, as well as certain electronic payments.
[4] The Tax Gap is the estimated difference between the amount of tax that taxpayers should pay and the amount that is paid voluntarily and on time.
[5] Systems such as “Pay Pal.”
[6] Electronic Transactions Association Executive Director to Representative John Lewis, April 3, 2007, House Committee on Ways and Means, Washington, D.C., http://waysandmeans.house.gov.
[7] As a result of our discussions with the IRS, this line on Schedule C was changed to read, “Returns and allowances plus any “cash back” amounts included on line 1a.”
[8] Taxpayers filing Supplemental Income and Loss (Schedule
E – Form 1040) or Profit or Loss From Farming (Schedule F – Form 1040) will be
instructed to enter any cash back included in the Form 1099-K amount as an
‘other’ expense when computing taxable income.
[9] There are numerous projects within the IRDM program requiring coordination and communication among internal and external stakeholders. The program schedule will need to be closely monitored and tracked to ensure that the program stays on track and lines of communication remain open. IRDM program performance will be affected as a result of any problems or delays with dependent projects or organizations.
[10] The Patient Protection and Affordable Care Act, Pub. L. No. 111-148, 124 Stat. 119 (2010). (The portion of this law that expanded the reporting requirements for Form 1099-MISC was repealed April 14, 2011.)
[11] Personally Identifiable Information is information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual.
[12] The Privacy Impact Assessment was created by the IRS’s Office of Privacy Advocate in 1995 to better ensure the confidentiality, integrity, and privacy of taxpayer information. It is a vehicle for addressing privacy issues in a system under development which also provides a means to assure compliance with applicable laws and regulations governing taxpayer and employee privacy.
[13] Business Systems Modernization: Internal Revenue Service’s Fiscal Year 2009 Expenditure Plan (GAO-09-281, dated March 2009).
[14] 44 U.S.C. §§ 3541–3549.
[15] Information Security: IRS Needs to Continue to Address Significant Weaknesses (GAO-10-355, dated March 2010).
[16] These include the Wage and Investment Division, the Small Business/Self-Employed Division, and the Large Business and International Division.
[17] The IRS database that consists of Federal tax-related transactions and accounts for businesses. These include employment taxes, income taxes on businesses, and excise taxes.
[18] The IRS database that maintains transactions or records of individual tax accounts.
[19] The IRS database that stores various types of taxpayer account information. This database includes individual, business, and employee plans and exempt organizations data.
[20] This is the data processing arm of the IRS. The campuses process paper and electronic submissions, correct errors, and forward data to the Computing Centers for analysis and posting to taxpayer accounts.