TREASURY INSPECTOR GENERAL FOR TAX ADMINISTRATION

 

 

Inadequate Aircard and BlackBerry® Smartphone Assignment and Monitoring Processes Result in Millions of Dollars in Unnecessary Access Fees

 

 

 

January 11, 2013

 

Reference Number:  2013-10-010

 

 

This report has cleared the Treasury Inspector General for Tax Administration disclosure review process and information determined to be restricted from public release has been redacted from this document.

 

Phone Number  /  202-622-6500

E-mail Address /  TIGTACommunications@tigta.treas.gov

Website           /  http://www.treasury.gov/tigta

 

 

HIGHLIGHTS

INADEQUATE AIRCARD AND BLACKBERRY® SMARTPHONE ASSIGNMENT AND MONITORING PROCESSES RESULT IN MILLIONS OF DOLLARS IN UNNECESSARY ACCESS FEES

Highlights

Final Report issued on January 11, 2013

Highlights of Reference Number:  2013-10-010 to the Internal Revenue Service Chief Technology Officer.

IMPACT ON TAXPAYERS

In Fiscal Year 2011, the IRS had approximately 35,000 active aircards and more than 4,400 BlackBerry® smartphones assigned to employees, providing them with mobile Internet and e-mail access.  TIGTA found that cost savings can be achieved if the IRS ensures that only those employees with a valid business need are assigned an aircard and/or BlackBerry® smartphone and provides more effective oversight and monitoring of these devices.  Improved policies and procedures can result in savings of $5.9 million over five years, which would help to support the President’s November 2011 Executive Order to cut waste in Federal Government spending and identify opportunities to promote efficient and effective spending.

WHY TIGTA DID THE AUDIT

This audit was initiated because the President issued an Executive Order in November 2011 directing Government agencies to cut combined costs by 20 percent in six areas, including information technology devices.  In Fiscal Year 2011, the IRS spent about $8.5 million on aircards and $2.9 million on BlackBerry® smartphones to enable employees to have mobile Internet and e-mail access.  Our objective was to determine whether the IRS is managing its aircards and BlackBerry® smartphones in a cost-effective manner.

WHAT TIGTA FOUND

Processes for assigning and monitoring the use of aircards and BlackBerry® smartphones are not adequate to ensure that employees have a business need for the devices.  Assignment of these devices is generally based on job series classifications without adequately ensuring a business need exists.

In addition, the IRS paid approximately $1.1 million during Fiscal Year 2011 for 13,878 aircards and 754 BlackBerry® smartphones that were not used for periods of three months to one year.  For example, TIGTA identified 45 aircards and 68 BlackBerry® smartphones that were not used at all for the entire 12 months of the fiscal year. 

Finally, 2,560 employees may have been assigned an aircard or BlackBerry® smartphone without required management approval.  These devices cost the IRS more than $950,000 in Fiscal Year 2011, or about $4.8 million over five years. 

WHAT TIGTA RECOMMENDED

TIGTA recommended that the IRS develop processes to periodically evaluate job series profiled for aircards and BlackBerry® smartphones and ensure managerial approval of devices is based on business need; establish a pooling policy for aircards; review its inventory records to identify devices shown as assigned to employees without proper management approval; develop a formalized process to identify BlackBerry® smartphones with no usage; and identify whether BlackBerry® smartphones with no data use could be replaced with a lower costing cellular telephone. 

In their response, IRS management agreed with two of our six recommendations.  IRS management agreed to establish a policy to periodically evaluate the job series profiled for aircards and BlackBerry® smartphones and agreed to formally document their process to monitor BlackBerry® smartphones with no usage.  Although IRS management disagreed with our recommendation to establish a pooling policy for aircards, they agreed to conduct a business assessment to determine if a shared aircard policy would be effective. 

IRS management disagreed with our three remaining recommendations, citing previously existing procedures.  Based on the large number of unapproved and unused devices identified during the audit, TIGTA believes the IRS should take action to enhance its existing controls.

 

January 11, 2013

 

 

MEMORANDUM FOR CHIEF TECHNOLOGY OFFICER

 

FROM:                       Michael E. McKenney /s/ Michael E. McKenney

                                  Acting Deputy Inspector General for Audit

 

SUBJECT:                  Final Audit Report – Inadequate Aircard and BlackBerry® Smartphone Assignment and Monitoring Processes Result in Millions of Dollars in Unnecessary Access Fees (Audit # 201110032)

 

This report presents the results of our review on how significant cost savings can be achieved in the Internal Revenue Service’s (IRS) aircard and BlackBerry® smartphone programs.  The overall objective of this review was to determine whether the IRS is managing its aircards and BlackBerry® smartphones in a cost‑effective manner.  This audit was included in our Fiscal Year 2012 Annual Audit Plan and addresses the major management challenge of Achieving Program Efficiencies and Cost Savings.

Management’s complete response to the draft report is included as Appendix V.

Copies of this report are also being sent to the IRS managers affected by the report recommendations.  If you have any questions, please contact me or Gregory D. Kutz, Assistant Inspector General for Audit (Management Services and Exempt Organizations).

 

 

Table of Contents

 

Background

Results of Review

Processes to Assign Aircards and BlackBerry® Smartphones Are Not Adequate

Recommendations 1 and 2:

Recommendation 3:

Employees Are Assigned Aircards and BlackBerry® Smartphones Without the Required Management Approval

Recommendation 4:

Unnecessary Usage Costs Are Being Paid for Unused and Underutilized Aircards and BlackBerry® Smartphones

Recommendations 5 and 6:

Appendices

Appendix I – Detailed Objective, Scope, and Methodology

Appendix II – Major Contributors to This Report

Appendix III – Report Distribution List

Appendix IV – Outcome Measures

Appendix V – Management’s Response to the Draft Report

 

 

Abbreviations

 

FY

Fiscal Year

IRS

Internal Revenue Service

IT

Information Technology

NTEU

National Treasury Employees Union

 

 

Background

 

In Fiscal Year (FY) 2011, the Internal Revenue Service (IRS) had approximately 35,000 aircards assigned to employees.  Aircards provide mobile Internet access from laptops when employees are working outside of an IRS office.  The IRS pays a monthly access fee that can range from $10.00 to $29.99 per month per card depending on the provider.  A per card fee is paid each month regardless of whether the card is used.  Aircard access fees totaled approximately $8.5 million for FY 2011.

In addition to aircards, the IRS also provides employees with BlackBerry® smartphones.  The IRS is not charged for the BlackBerry® smartphone device; rather it is charged monthly access fees ranging from $40.00 to $63.00 per month per device depending on the provider.  The IRS incurs this monthly fee regardless of whether the BlackBerry® smartphone is used.  In FY 2011, the IRS had approximately 4,400 BlackBerry® smartphones assigned to employees, costing approximately $2.9 million.  

The IRS and National Treasury Employees Union (NTEU) agreement standardizes telecommunications equipment assigned to employees

In June 2010, the IRS and the NTEU signed an agreement to standardize IRS policy regarding which IRS employees would be allowed (referred to as a “profiled” position in the agreement) to receive certain information technology equipment, including aircards and BlackBerry® smartphones.  The IRS determined that employees would be profiled for information technology equipment based on their mobility needs.  For example, those employees in occupations that conduct frequent field visits and travel to different locations were classified as “high mobility” and, as such, can receive an aircard. 

In conjunction with this agreement, the IRS evaluated more than 390 employee positions to determine the mobility of the positions and the type of information technology equipment necessary to perform the work required by those positions.  This evaluation resulted in 71 different job series being profiled as high mobility.  Employees holding positions in these profiled job series are entitled to receive an aircard.  BlackBerry® smartphones were initially assigned only to executives and senior departmental managers beginning in October 2008.  However, the IRS subsequently agreed in June 2010 to provide BlackBerry® smartphones to employees depending on their job series, grade, and need for such a device.

If an IRS employee has been profiled for an aircard or BlackBerry® smartphone, they can request the device from the IRS Information Technology (IT) organization.  IT organization management stated that an employee in a profiled job series must obtain management approval before the request can be sent to IT organization personnel to assign the device.  The IT organization verifies that the employee’s position is profiled for the device requested and then provides the device to the employee.  The NTEU agreement also contains an exception policy that allows nonprofiled employees to request telecommunications equipment through their manager.

This review was performed at the IRS National Headquarters in Washington, D.C.; the IRS Procurement office in Oxon Hill, Maryland; and the IT organization offices in New Carrollton, Maryland; Detroit, Michigan; and Philadelphia, Pennsylvania, during the period October 2011 through August 2012.  We conducted this performance audit in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objective.  We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective.  Detailed information on our audit objective, scope, and methodology is presented in Appendix I.  Major contributors to the report are listed in Appendix II.

 

 

Results of Review

 

The processes for assigning and monitoring the use of aircards and BlackBerry® smartphones are not effective.  We found that assignment of these devices is generally based on job series classifications without adequately ensuring a business need exists.  For example, management did not always consider the frequency that an employee actually works outside an IRS office prior to assigning devices.  We also found that required managerial approvals were not always obtained when employees who were not in a profiled job series were assigned these devices.  We identified 2,560 devices without a documented management approval, costing the IRS more than $950,000 in FY 2011, or potentially about $4.8 million over five years.

In addition, processes for monitoring aircard and BlackBerry® smartphone use do not ensure the IRS is not paying for unused or underutilized equipment.  Established processes to notify employees when aircards were not used for 90 calendar days were not being followed, and there was no formal process to monitor BlackBerry® smartphone use for similar periods of inactivity.  For example, we identified periods of inactivity during FY 2011 for aircards and BlackBerry® smartphones ranging from three to 12 months; however, the IRS still incurred monthly access fees totaling approximately $1.1 million for these devices.  Overall, process improvements can result in cost savings totaling approximately $5.9 million over five years.  Of this, approximately $2.1 million could potentially be saved in the first year.

Implementation of more effective assignment and monitoring processes will reduce technology costs in support of the President’s November 2011 Executive Order[1] to cut waste in Federal Government spending and identify opportunities to promote efficient and effective spending.  The Executive Order directed Federal agencies to cut combined costs by 20 percent in six areas, including information technology devices.  Agencies were directed to assess current device inventories and usage, and establish controls to ensure that they are not paying for unused or underutilized information technology equipment, installed software, or services.  Further, each agency was requested to take steps to limit the number of information technology devices issued to employees, e.g., mobile telephones, smartphones, desktop and laptop computers, and tablet personal computers.

Processes to Assign Aircards and BlackBerry® Smartphones Are Not Adequate

Aircards and BlackBerry® smartphones are generally assigned to IRS employees based on job series classifications.  Although IRS management stated that the job series profiled as high mobility were based on factors such as travel and work outside the office, which includes working in locations without Internet connectivity and employees who telework,[2] our review indicated that some job series profiled may not involve frequent travel and therefore may not justify a business need for these devices.  The IRS has not established a process to periodically review the profiled job series to ensure the positions still involve high mobility as initially profiled.  For example, IT organization specialists are in a job series profiled as high mobility – frequent travel outside of the office.  However, the standard position description for an IT organization specialist (Applications Software) notes that the work performed by this position is primarily sedentary and requires only some travel away from the work site to attend meetings and conferences or to visit vendor/contractor facilities.

In addition, managerial review of profiled employee requests for devices does not always ensure that requesting employees have a business need before devices are assigned.  IT organization management stated that an employee in a profiled job series must obtain management approval before a request for assignment of a device is sent to IT organization personnel.  IT organization personnel will verify only whether the employee has been profiled and relies on the employee’s manager to ensure a business need exists for assigning the device.    

Further, we found that there is no consistent process followed within the business units when determining whether an exception should be granted for requests from employees in nonprofiled job series.  Discussions with business unit coordinators identified that there are no documented procedures or formalized processes to be followed when determining whether an exception should be granted, i.e., frequency of travel outside an IRS office.  We found that requests can be made informally via e-mail within some business units, while others require a standardized form to be completed.  Further, the level of management approval required for the exceptions varies between the business units.

IRS policy does not specify assignment criteria for a BlackBerry® smartphone

Similar to aircards, assignment of BlackBerry® smartphones is based on job series that were classified by IRS management subsequent to the NTEU agreement.  Initially, IRS policy limited the assignment of BlackBerry® smartphones to executives and senior/departmental managers.  However, the agreement between the IRS and the NTEU expanded availability to employees below the executive and senior/departmental level.  Although the agreement indicates that assigning employees a device will be based on job series and grade, the final agreement was silent on which specific job series and grade levels are eligible for a BlackBerry® smartphone.  For example, there are no specific criteria in the agreement, nor is there any IRS guidance for assigning frontline managers and nonmanagement employees a BlackBerry® smartphone.

As of May 2012, there were 5,124 BlackBerry® smartphones assigned to IRS employees.  We determined that the majority of BlackBerry® smartphones are not assigned to executives and senior/departmental managers as the policy initially set forth.  In fact, 3,060 (60 percent) of these devices are now assigned to frontline managers (872) or nonmanagement employees (2,188).  These 3,060 devices cost the IRS approximately $1.6 million in FY 2011.  Similar to the processes for assigning aircards, processes need to be developed to ensure that managerial approval of these devices is based on business need criteria, such as the frequency of work outside an IRS office.

Pooling can provide an opportunity to reduce costs while ensuring employees have the tools they need to do their jobs

To ensure employees have the necessary tools to perform their jobs and reduce costs, the IRS should develop a pooling process.  For example, aircards could be maintained in a central office location and assigned to employees as needed, then returned when the employees were not working outside an IRS office.

During our audit, some business unit coordinators informed us they tried to establish a loaner program for aircards in which they could be assigned to the office manager at each location and signed out to employees on travel.  However, at that time, the information technology inventory system used to record and track these devices required they be assigned to specific individuals.  As a result, the pooling programs were stopped.  Since that time, IT organization management has implemented a new inventory system that will allow for the recording and tracking of devices that are loaned out.  One business unit informed us that it has initiated a pilot program to pool aircards for emergencies or travel.  A pooling approach can allow the IRS to reduce the number of aircards currently assigned to individuals who do not frequently work outside an IRS office, yet provide the availability of these devices when needed.   

Recommendations

The Chief Technology Officer should:

Recommendation 1:  Develop a process that periodically evaluates the job series currently profiled for aircards and BlackBerry® smartphones to ensure those profiled job series still involve positions with high mobility.

Management’s Response:  IRS management agreed and stated they will establish a policy to implement the recommendation.

Recommendation 2:  Develop a process to ensure that managerial approval of devices is based on business need criteria, such as the frequency of work outside an IRS office by the requesting employee.

Management’s Response:  IRS management disagreed with this recommendation and stated they have had appropriate processes documented and working effectively since June 2010.  The requirement for managerial approval based on the employee’s business requirements is in place and is systemically required for any employee requesting nonprofiled equipment.

Office of Audit Comment:  During our review, we identified 13,878 aircards and 754 BlackBerry® smartphones that were not used during FY 2011 for periods ranging from three months to one year.  This is after the June 2010 date for which the IRS indicated that it implemented effective processes to address our recommendation.  Our work indicates that employees whose job duties do not require frequent work outside the office have been assigned devices.  In addition, our work found there is no consistent process followed within the business units when determining whether employees in a nonprofiled job series are granted a BlackBerry® smartphone or aircard.  As a result, we continue to believe that IRS management should take action to enhance existing controls and ensure a consistent, documented process exists for the business units when approving these devices for nonprofiled employees. 

Recommendation 3:  Establish a pooling policy to provide availability of aircards to employees who do not frequently travel outside an IRS office when a business need exists.

Management’s Response:  IRS management disagreed with this recommendation.  However, IRS management stated they will conduct a business assessment regarding aircards to determine if a shared aircard policy would be more effective than the current policy.  We believe this action addresses the intent of our recommendation.

Employees Are Assigned Aircards and BlackBerry® Smartphones Without the Required Management Approval

Our review identified 2,560 devices assigned to IRS employees who, per IRS inventory records, were not in a profiled job series.  These aircard and/or BlackBerry® smartphone devices were assigned without the required management approval.  For example, we identified:

Our analysis of a random sample of 60 of the 2,560 devices (30 aircards and 30 BlackBerry® smartphones) found that for 40 (67 percent) of the 60 devices, the business unit coordinators agreed the devices were assigned to employees who were not in a profiled job series, and therefore, they are required to have documented management approval supporting the exception for the equipment.  The coordinators informed us that they believed 14 of these 40 devices were cancelled and were no longer in possession of the employee.  The applicable business unit coordinator for one of the remaining 20 devices stated that it was inaccurately reflected in inventory records as being assigned to an employee who was not in possession of the device.

For the remaining 19 devices, the coordinators provided us with documentation supporting either that the employee was in a profiled job series allowing them to be assigned the device or had management approval for the device.  However, inventory records were inaccurate because they were not updated to reflect the management approval for these devices.  During our field work, IT organization management stated that they have experienced technical issues with their inventory system, resulting in lost data.  As a result, they had to reconstruct their database using prior records, which resulted in errors in the inventory records.  At the end of our field work, IT organization management did not have an established process to identify employees assigned devices who are in a nonprofiled job series and do not have a documented management approval for the devices.

Based on concerns we identified during this review related to the accuracy of the IT organization’s inventory records, we plan to initiate a separate review assessing inventory controls over these devices. 

Recommendation

The Chief Technology Officer should:

Recommendation 4:  Develop processes and procedures to ensure IT organization management periodically reviews its inventory records to identify devices shown on its system as assigned to employees without proper management approval or in accordance with established procedures.

Management’s Response:  IRS management disagreed with this recommendation and stated they have appropriate processes documented and working effectively.  IRS management indicated they have implemented a process to compare current BlackBerry® smartphone and aircard accounts against the existing Equipment Portfolio to identify any employee who is no longer profiled as a result of a change in his or her roles or responsibilities.  IRS management stated this process was modified on October 1, 2012, to run monthly, rather than quarterly, as initially designed.

Office of Audit Comment:  During our field work, IRS management did not provide us with any documentation or indicate they have a process requiring IT organization management to identify these types of devices on a quarterly basis and take appropriate action.  In their response, IRS management stated they have appropriate processes in place to identify these devices; however, they indicated that the specified process was updated on October 1, 2012, which was after we completed our field work.  Based on the number of devices that we identified on their inventory records as being in a nonprofiled job series without management approval, we are concerned that the current process is not adequate to address the reported weaknesses.  As a result, we continue to believe the IRS should take action to enhance its existing controls.

Unnecessary Usage Costs Are Being Paid for Unused and Underutilized Aircards and BlackBerry® Smartphones

The IRS paid approximately $1.1 million during FY 2011 for 13,878 aircards and 754 BlackBerry® smartphones that were not used for periods ranging from three months to one year.  For example, we identified 45 aircards and 68 BlackBerry® smartphones that were not used at all for the entire 12 months of the fiscal year.  During FY 2011, the IRS paid more than $48,000 in monthly access fees for these 113 devices.  For example, a BlackBerry® smartphone was assigned as of May 2012 to a contact representative whose main duty is to answer calls on the IRS’s toll‑free telephone line from individuals requesting technical or procedural information and assistance.  Figure 1 provides the FY 2011 breakdown of the aircards and BlackBerry® smartphones with no usage.

Figure 1:  Volume of Devices With No Use During FY 2011 Ranging From
Three to 12 Months and the Associated Monthly Access Fees Paid

Months of No Usage

Aircards With No Usage

Monthly Access Fees Paid

BlackBerry® Smartphones With No Usage

Monthly Access Fees Paid

3

3,559

$149,478

177

$23,614

4

3,553

$198,968

149

$26,504

5

2,603

$182,210

78

$17,343

6

1,935

$162,540

59

$15,742

7

1,129

$110,642

60

$18,677

8

612

$68,544

48

$17,076

9

253

$31,878

42

$16,810

10

119

$16,660

40

$17,788

11

70

$10,780

33

$16,143

12

45

$7,560

68

$36,288

Totals

13,878

$939,260

754

$205,985

Source:  Our analysis of FY 2011 service provider usage reports.

Notification e-mails were not always sent as required to employees assigned aircards with 90 consecutive days of no use

Our review identified that management developed a process to monitor aircards for no use; however, notification e-mails were not always sent as required.  A similar process has not been implemented to monitor BlackBerry® smartphones for nonusage.  IT organization personnel are responsible for monitoring aircard use on a monthly basis using service provider usage reports.  These reports include a breakdown of employees who have not used their aircard at all for 90 consecutive days (three months).  In FY 2010, the IRS implemented a policy requiring IT organization personnel to e‑mail employees identified as not using their aircard for 90 consecutive days, notifying them that the card will be cancelled.  The employees are required to contact their business unit coordinator if they do not want their card cancelled.  Business unit coordinators are responsible for informing IT organization personnel on whether to cancel the aircard. 

Our review of a random sample of 36 aircards appearing on the 90-day zero usage reports for FY 2011 (three aircards per month) identified that IT organization personnel did not send e-mails as required to 11 (31 percent) of the 36 employees.  IT organization management informed us that the review of the usage reports is a manual process, which may have contributed to the failure to send e-mails as required.  On any given month in FY 2011, there was an average of about 3,000 employees on the 90-consecutive-day zero usage report.  We determined that IRS management cancelled 6,800 aircards in FY 2011, of which 5,325 were cancelled following
90 days of zero usage.  

Cellular telephones may provide a lower cost option to meet business needs for some employees assigned BlackBerry® smartphones

We identified BlackBerry® smartphones for which the telephone service was being used but no data usage occurred during FY 2011.  The BlackBerry® smartphone data capability enables the employee to check e-mail and access the Internet.  We identified 18 BlackBerry® smartphones with no data use for three to five months and six BlackBerry® smartphones with no data use for six months or more for which the telephone service was used.  As a result, the IRS is paying more for a BlackBerry® smartphone when the individual is using it only for the telephone service.  These 24 BlackBerry® smartphones cost the IRS about $4,000.

We did not review the IRS’s costs associated with cellular telephones (cellphones) during this review; we focused our work on devices providing data access.  However, the IRS may be able to lower costs for those employees we identified as not using the data capability of the BlackBerry® smartphone by determining whether a cellular telephone should be provided instead of a BlackBerry® smartphone.  Cellular telephones generally cost about $18.28 less per month than BlackBerry® smartphones.

Recommendations

The Chief Technology Officer should:

Recommendation 5:  Develop a formalized process, similar to the aircard process, to identify BlackBerry® smartphones with no usage to ensure a business need still exists for assignment of the device.  In addition, ensure “no usage” notification procedures established for both aircards and BlackBerry® smartphones are followed. 

Management’s Response:  IRS management agreed with this recommendation and stated they have formally documented their nonusage cancellation process for BlackBerry® smartphones.

Recommendation 6:  Develop processes to identify employees assigned a BlackBerry® smartphone with no data use to determine whether the BlackBerry® smartphone should be replaced with a lower costing cellular telephone. 

Management’s Response:  IRS management disagreed with this recommendation and stated they have had appropriate processes documented and working effectively since June 2010.  One process requires IRS management to evaluate each BlackBerry® smartphone request in lieu of a cellphone.  In addition, IRS management stated employees assigned a BlackBerry® smartphone with no data usage could lose that BlackBerry® smartphone in conjunction with the existing BlackBerry® smartphone nonusage cancellation process.

Office of Audit Comment:  IRS management indicated that they implemented effective processes in June 2010 that they believe address our recommendation.  However, IRS management did not provide us during our review any formalized procedures related to the process followed to monitor BlackBerry® smartphones with no data usage.  In addition, we did not identify any actions taken by the IRS to monitor BlackBerry® smartphones with no data usage.  The IRS indicated its process for identifying BlackBerry® smartphones with no usage was documented in November 2012, after we completed our field work.  As a result, we cannot comment on whether the formalized process fully addresses our recommendation.  However, we continue to believe that any process used by the IRS to identify inefficient use of BlackBerry® smartphones should include identifying both BlackBerry® smartphones with no usage (data or voice) and BlackBerry® smartphones for which telephone service is being used but data service is not.

 

Appendix I

 

Detailed Objective, Scope, and Methodology

 

The overall objective of this review was to determine whether the IRS is managing its aircards and BlackBerry® smartphones in a cost-effective manner.  To accomplish our objective, we:

I.                 Determined whether policies, procedures, and guidelines relating to the IRS’s use and management of aircards have been developed and issued.

A.    Obtained and reviewed all policies, procedures, and guidelines pertaining to the submission, review, and approval of aircards.

B.    Obtained and reviewed all policies, procedures, and guidelines for monitoring the aircards.

C.    Obtained and reviewed the policies, procedures, and guidelines for deactivating aircards returned by IRS personnel.

II.               Determined whether policies, procedures, and guidelines governing the IRS’s use and management of BlackBerry® smartphones and other mobile devices have been developed and issued.

A.    Obtained and reviewed all policies, procedures, and guidelines pertaining to the submission for, review and approval of, and issuance of BlackBerry® smartphones.

B.    Obtained and reviewed all policies, procedures, and guidelines for monitoring the use of BlackBerry® smartphones.

C.    Obtained and reviewed the policies, procedures, and guidelines for deactivating mobile devices returned by IRS personnel.

III.             Identified any steps taken by the IRS to reduce the costs associated with wireless technologies.  We interviewed applicable IT organization and business unit management and determined whether they have evaluated the use of wireless technologies to identify any cost savings that can be achieved

IV.            Determined whether actions can be taken to reduce the costs of aircards.

A.    Determined how the IRS manages and monitors the costs of aircards.

B.    Determined how the IRS purchases aircards and whether it is done in a cost-effective manner.

V.              Determined whether actions were taken to reduce the costs of BlackBerry® smartphones and other mobile devices.

A.    Determined how IRS management monitors the costs of BlackBerry® smartphones and other mobile devices.

B.    Determined how the IRS purchases BlackBerry® smartphones and whether it is done in a cost-effective manner.

C.    Determined whether costs associated with data access on BlackBerry® smartphones can be reduced.

D.    Selected and reviewed a random sample of 30 of the 1,000 BlackBerry® smartphone users and 30 of the 1,560 aircard users (with an assigned device as of May 2012) to determine whether they were profiled for use or were given an exception to receive the devices.

E.     Selected a random sample of 36 aircards appearing on the 90-day zero usage reports for FY 2011 (three aircards per month) to determine if IT organization personnel sent e-mails to employees as required.

In completing our review, we relied on detailed aircard and BlackBerry® smartphone inventory data from the IRS and data usage reports from AT&T, Verizon, and Sprint.  In order to assess the reliability of these inventory and usage reports, data were reviewed for accuracy.  We reviewed samples of the data to verify their accuracy and identified that numerous employee data were missing or incorrect.  However, we found the data to be reliable for the limited purposes of this audit and performed no other data validity tests.

Internal controls methodology

Internal controls relate to management’s plans, methods, and procedures used to meet their mission, goals, and objectives.  Internal controls include the processes and procedures for planning, organizing, directing, and controlling program operations.  They include the systems for measuring, reporting, and monitoring program performance.  We determined the following internal controls were relevant to our audit objective:  the IRS’s policies and procedures for assigning and monitoring aircards and BlackBerry® smartphones.  We evaluated these controls by interviewing IRS management and reviewing aircard and BlackBerry® smartphone inventory and billing data.

 

Appendix II

 

Major Contributors to This Report

 

Nancy A. Nakamura, Assistant Inspector General for Audit (Management Services and Exempt Organizations)

Russell P. Martin, Acting Assistant Inspector General for Audit (Management Services and Exempt Organizations)

Jeffrey M. Jones, Director

Joseph F. Cooney, Audit Manager

Larry Reimer, Audit Manager

Terrey A. Haley, Lead Auditor

Kanika Kals, Senior Auditor

Kevin Liu, Senior Auditor

Autumn E. Gill, Evaluator

 

Appendix III

 

Report Distribution List

 

Commissioner  C

Office of the Commissioner – Attn:  Chief of Staff  C

Deputy Commissioner for Operations Support OS

Deputy Chief Information Officer for Operations OS:CTO

Associate Chief Information Officer, End-User Equipment and Services  OS:CTO:UNS

Director, Operations Service Support  OS:CTO:UNS

Chief Counsel  CC

National Taxpayer Advocate  TA

Director, Office of Legislative Affairs  CL:LA

Director, Office of Program Evaluation and Risk Analysis  RAS:O

Office of Internal Control  OS:CFO:CPIC:IC

Audit Liaison:  Chief Technology Officer  OS:CTO

 

Appendix IV

 

Outcome Measures

 

This appendix presents detailed information on the measurable impact that our recommended corrective actions will have on tax administration.  These benefits will be incorporated into our Semiannual Report to Congress.

Type and Value of Outcome Measure:

·       Cost Savings – Funds Put to Better Use – Potential; $424,008 per year for FY 2011 through FY 2015, totaling approximately $2.1 million over five years.  This represents the aircard costs that could potentially be avoided if the IRS periodically reviews its inventory system and takes appropriate action for devices shown on its system as assigned to employees without proper management approval or in accordance with established procedures (see page 6).

Methodology Used to Measure the Reported Benefit:

We analyzed the IRS’s inventory records as of May 2012 and determined that 2,018 of 30,834 aircards were assigned to IRS employees who were not profiled to receive them based on their job series.  Our review showed that 1,560 of these 2,018 aircards do not have a documented exception, i.e., management approval, reflected on IT organization inventory records.  As a result, these employees may not have a business need for the aircards.  Based on an average cost of $22.65 per aircard per month, we estimate that these aircards cost $424,008 in FY 2011 ($22.65 x 12 months x 1,560 = $424,008).  Over a five-year period, this would result in aircard cost savings of approximately $2,120,040 ($424,008 x five years = $2,120,040).

Type and Value of Outcome Measure:

·       Cost Savings – Funds Put to Better Use – Potential; $533,640 per year for FY 2011 through FY 2015, totaling approximately $2.7 million over five years.  This represents the BlackBerry® smartphone costs that could potentially be avoided if the IRS periodically reviews its inventory system and takes appropriate action for devices shown on its system as assigned to employees without proper management approval or in accordance with established procedures (see page 6).

Methodology Used to Measure the Reported Benefit:

We analyzed the IRS’s inventory records as of May 2012 and determined that 2,123 of 5,124 BlackBerry® smartphones were assigned to IRS employees who were not profiled to receive them based on their job series.  Our review showed that 1,000 of these 2,123 BlackBerry® smartphones do not have a documented exception, i.e., management approval, reflected on IT organization inventory records.  As a result, these employees may not have a business need for these BlackBerry® smartphones.  Based on an average cost of $44.47 per BlackBerry® smartphone per month, we estimate that these devices cost $533,640 in FY 2011 ($44.47 x 12 months x 1,000 = $533,640).  Over a five-year period, this would result in BlackBerry® smartphone cost savings of approximately $2,668,200 ($533,640 x five years = $2,668,200).

Type and Value of Outcome Measure:

·       Cost Savings – Funds Put to Better Use – Potential; $939,260 (see page 8).

Methodology Used to Measure the Reported Benefit:

Our analysis of FY 2011 usage reports provided to the IRS showed that approximately 39 percent of the employees assigned an aircard (13,878 of 35,241) did not use their aircard for three or more months during FY 2011.  Based on an average zero usage cost of $14.00 per aircard per month, we estimate that these devices cost $939,260 in FY 2011.  See Figure 1 on page 8 for additional details.

Type and Value of Outcome Measure:

·       Cost Savings – Funds Put to Better Use – Potential; $205,985 (see page 8).

Methodology Used to Measure the Reported Benefit:

We analyzed FY 2011 usage reports and determined that 16 percent of the employees assigned a BlackBerry® smartphone (754 of 4,705) did not use it (no voice or data) for three or more months.  Based on an average cost of $44.47 per BlackBerry® smartphone per month, we estimate that these devices cost $205,985 in FY 2011.  See Figure 1 on page 8 for additional details.

  

Appendix V

 

Management’s Response to the Draft Report

 

DEPARTMENT OF THE TREASURY

INTERNAL REVENUE SERVICE

WASHINGTON, D.C. 20224

 

chief technology officer

 

MEMORANDUM FOR DEPUTY INSPECTOR GENERAL FOR AUDIT

 

FROM:                       for Terence V. Milholland /s/ Robert Crawford

                                         Chief Technology Officer

 

 

SUBJECT:                       Draft Audit Report -Inadequate Aircard and BlackBerry® Smartphone Assignment and Monitoring Processes Result in Millions of Dollars in Unnecessary Access Fees (Audit# 201110032) (e-trak# 2013-37067)

 

Thank you for the opportunity to review and respond to the subject draft report.

 

As noted in our full response, we already have processes in place that address the majority of the concerns raised in your recommendations, and these new processes have been working as designed.  As a result, we do not agree with the outcome measures described in the report, which do not take into consideration the IRS processes already in place.  For the same reason, we strongly disagree with the title to the draft report, and we suggest that title be changed to "Cost Saving Opportunities Exist in the Refinement of Air Card and BlackBerry® Smartphone Assignment and Monitoring Processes".

 

Any actions we will take as a result of your recommendations are outlined in the attached responses.

 

We are committed to continuously improving our business processes as they continue to evolve, and we value the guidance your team provides.  If you have any questions, please contact me at (202) 622-6800, or a member of your staff may contact Lisa J. Starr at (202) 283-3607.

 

Attachment

 

RECOMMENDATION #1:  The Chief Technology Officer should develop a process that periodically evaluates the job series currently profiled for aircards and BlackBerry® smartphones to ensure those profiled job series still involve positions with high mobility.

 

CORRECTIVE ACTION #1:  As a result of the October 1 implementation of the updated Article 50 of the NTEU agreement, the IRS agrees with this recommendation.  We will establish a policy to implement the recommendation.

 

IMPLEMENTATION DATE:  June 30, 2013

 

RESPONSIBLE OFFICIAL:  Associate Chief Information Officer, User and Network Services

 

CORRECTIVE ACTION MONITORING PLAN:  We enter accepted Corrective Actions into the Joint Audit Management Enterprise System (JAMES) and monitor them on a monthly basis until completion.

 

RECOMMENDATION #2The Chief Technology Officer should develop a process to ensure that managerial approval of devices is based on business need criteria, such as the frequency of work outside an IRS office by the requesting employee.

 

CORRECTIVE ACTION #2:  The IRS disagrees with this recommendation, as we already have appropriate processes documented and working effectively.  The requirement for managerial and Business Systems Planning (BSP) approval based on the employee's business requirements is in place.  Managerial and BSP approval is systemically required for any employee requesting non-profiled equipment.

 

IMPLEMENTATION DATE:  Process have been in place since June 2010

 

RESPONSIBLE OFFICIAL:  Associate Chief Information Officer, User and Network Services

 

CORRECTIVE ACTION MONITORING PLAN:  We enter accepted Corrective Actions into the Joint Audit Management Enterprise System (JAMES) and monitor on a monthly basis until completion.

 

RECOMMENDATION #3:  The Chief Technology Officer should establish a pooling policy to provide availability of aircards to employees who do not frequently travel outside an IRS office when a business need exists.

 

CORRECTIVE ACTION #3:  The IRS disagrees with this recommendation.  However, we will conduct a business assessment of the impact from Article 50, Section 20, regarding aircards to determine if a shared aircard policy would now be more effective than the current processWe will re-look at this recommendation once that assessment is complete.

 

IMPLEMENTATION DATE:  July 1, 2013 to conduct the assessment

 

RESPONSIBLE OFFICIAL: Associate Chief Information Officer, User and Network Services

 

CORRECTIVE ACTION MONITORING PLAN:  We enter accepted Corrective Actions into the Joint Audit Management Enterprise System (JAMES) and monitor them on a monthly basis until completion.

 

RECOMMENDATION #4:  The Chief Technology Officer should develop processes and procedures to ensure IT management periodically reviews its inventory records to identify devices shown on its system as assigned to employees without proper management approval or in accordance with established procedures.

 

CORRECTIVE ACTION #4:  The IRS disagrees with this recommendation, as we already have appropriate processes documented and working effectively.  We have already implemented a process to compare current BlackBerry® smartphone and aircard accounts against the existing Equipment Portfolio to identify any employee that is no longer profiled as a result of a change in his or her roles or responsibilities.  Notification emails are sent to the employee requesting the return of the device or immediate action to secure a BSP-approved exception by way of established process.  After 30 days, the account is cancelled if no exception is provided.  On October 1, 2012, we modified this process to run monthly, rather than quarterly, as initially designed.

 

IMPLEMENTATION DATE:  Processes updated October 1, 2012

 

RESPONSIBLE OFFICIAL:  Associate Chief Information Officer, User and Network Services

 

CORRECTIVE ACTION MONITORING PLAN:  We enter accepted Corrective Actions into the Joint Audit Management Enterprise System (JAMES) and monitor them on a monthly basis until completion.

 

RECOMMENDATION #5:  The Chief Technology Officer should develop a formalized process, similar to the aircard process, to identify BlackBerry® smartphones with no usage to ensure a business need still exists for assignment of the deviceIn addition, ensure "no usage" notification procedures established for both aircards and BlackBerry® smartphones are followed.

 

CORRECTIVE ACTION #5:   The IRS agrees with this recommendation.  We had a 30-day non-usage cancellation process in place for BlackBerry® smartphones, but we have since formally documented it by having it signed by the Associate Chief Information Officer, User and Network Services.

 

IMPLEMENTATION DATECompleted November 2012

 

RESPONSIBLE OFFICIAL:  Associate Chief Information Officer, User and Network Services

 

CORRECTIVE ACTION MONITORING PLAN:  We enter accepted Corrective Actions into the Joint Audit Management Enterprise System (JAMES) and monitor them on a monthly basis until completion.

 

RECOMMENDATION 6:  The Chief Technology Officer should develop processes to identify employees assigned a BlackBerry® smartphone with no data use to determine whether the BlackBerry® smartphone should be replaced with a lower costing cellular telephone.

 

CORRECTIVE ACTION #6:  The IRS disagrees with this recommendation, as we already have appropriate processes documented and working effectively.  We have a process in place for IRS management to evaluate each BlackBerry® smartphone request in lieu of a cell phone.  In conjunction with the existing BlackBerry® smartphone non-usage cancellation process, employees assigned a BlackBerry® smartphone with no data usage could lose that BlackBerry® smartphone.  IRS management is able to assess at that point whether or not providing a cell phone would be appropriate.

 

IMPLEMENTATION DATE:  Completed June 2010

 

RESPONSIBLE OFFICIAL:  Associate Chief Information Officer, User and Network Services

 

CORRECTIVE ACTION MONITORING PLAN:  We enter accepted Corrective Actions into the Joint Audit Management Enterprise System (JAMES) and monitor them on a monthly basis until completion.



[1]Exec. Order No. 13,589, 3 C.F.R. § 13,589 (2011).

[2] Telework employees are those who work full- or part-time on a routine basis at home or another location away from the office.