Review Of Taxpayer Requests For
Disclosure Of Tax Information
Reference No: 090804 Date: November 4, 1998
Table of contents
Objective and Scope
Processing controls are not adequate to prevent
Requirements for the release of tax return transcripts
needs improvement to prevent unauthorized disclosure of tax information
needs improvement to prevent unauthorized disclosure
of tax information
Taxpayer written requests for return information are not
properly maintained to protect the Service from unauthorized
Required letters are not consistently issued to taxpayers
when their requests for tax information are not processed within 30 days
when their requests for tax information are not processed
within 30 days
Attachment I - Detailed Objectives and Scope
Attachment II – Management Response
In fiscal year 1997, the Service received over 1.1 million requests for tax return information from the public. Requests are made for photocopies of tax returns or for transcripts of tax return information. Financial institutions and the Federal government generally request tax information for income verification purposes prior to granting loans.
Beginning October 1, 1994, the Service offered to provide taxpayers with transcripts of return information free of charge as an alternative to providing photocopies of returns at a cost to the taxpayer of $14. Providing transcripts of return information has increased the potential for unauthorized disclosure of tax information.
The Service is extremely vulnerable to unauthorized disclosure of tax return information.
Four significant issues warrant management’s attention:
Internal Audit submitted invalid written requests for tax return transcripts and the Service made an unauthorized disclosure in 46% of the requests. Tax return transcripts were sent to third parties based on requests that were not signed by the taxpayer. Other unsigned requests were honored and transcripts were sent to addresses other than the taxpayer’s Master File address.
Individuals can obtain tax return information of a taxpayer even if they do not know the taxpayer’s Social Security Number (SSN). Internal Revenue Service guidelines allow research to add information missing from the written requests, including the SSN. Individuals only have to provide the taxpayer’s name and address and sign the request as the taxpayer to obtain the information. Internal audit submitted signed requests without taxpayers’ SSNs and received 83% of the tax return transcripts requested.
Management could not locate 5% of the written requests for tax return information. Such documentation is necessary to support employee computer accesses for all tax returns and transcripts issued.
We also found that required letters are not consistently issued to taxpayers when their requests for tax information are not processed within 30 days.
The following summarizes the specific recommendations contained in this report. The Service should:
Management Response: Management has agreed to take appropriate corrective action in response to each recommendation in the report. Management’s actions are summarized in the body of the report and the entire response is included as Attachment II.
Objective and Scope
This review was initiated as a result of a local research project which disclosed controls over tax information to prevent unauthorized disclosure may need improvement. The audit fieldwork was conducted between June 1997 and March 1998 at two service centers in the Northeast Region (NER), one service center in the Southeast Region (SER) and one service center in the Western Region (WR), and was conducted in accordance with generally accepted government auditing standards.
The overall objective of the audit was to evaluate the Service’s process for responding to taxpayer requests for disclosing tax return information and ensuring that legal and procedural requirements were met. Also, determine whether the Service evaluated the legal impact of receiving information on potentially non-compliant taxpayers from third parties.
A detailed description of the specific objectives and audit coverage is included in Attachment I.
Taxpayers may request a copy of their tax return or an official tax return transcript be disclosed to a third party. The request, or consent, must be in the form of a written document and signed and dated by the taxpayer who filed the return. Generally, taxpayers use Form 4506 (Request for copy or Transcript of Tax Form). The service centers process these written requests under the provisions of the Internal Revenue code (IRc) 6103.
Financial institutions evaluate loan applications and one of their standard procedures is to verify the applicant’s income from Internal Revenue Service (IRS) records. Some financial institutions, instead of directly contacting the IRS for taxpayer data, send taxpayer requests through a centralized credit institution who, in turn, obtains the information from the IRS for the institutions or taxpayers and forwards the information to whomever the taxpayer designates.
The Small Business Administration (SBA) requests a transcript of a taxpayer’s return in order to process federally funded disaster loans. This government agency receives preferential treatment in order to process the requests as quickly as possible.
The financial institutions and SBA have taxpayers complete a request form for a copy or transcript of their tax return. Taxpayers can authorize other third parties permissions to receive the same information.
The general public expects the Service to take measures to protect the confidentiality of tax return information. The Service has the responsibility to make certain that disclosures of federal tax return information be made as authorized by laws and regulations. Taxpayers may bring civil suit action for damages against the United States if Service employees violate disclosure laws.
In fiscal year 1997 the Return and Income Verification Services (RAIVS) functions processed 691,000 requests for transcripts of tax information. Small Business Administration Disaster Program accounted for 188,000 of the requests. Also, the RAIVS functions processed 468,000 requests for photocopies of returns. The Service charges a $23 fee for each photocopy of a return but transcripts of tax information are provided free of charge.
Service records showed that the RAIVS functions processed over 1.1 million requests for tax return information in fiscal year 1997. However, the quality of the work processed by the RAIVS functions needs improvement to prevent possible unauthorized disclosure of tax return information.
The following significant issues warrant management’s attention:
We also found that required letters are not consistently issued to taxpayers when their requests for tax information are not processed within 30 days.
Based on a recommendation from the Assistant chief counsel (Disclosure Litigation) the Service should consider obtaining customer authorizations that meet the requirements of the Right to Financial Privacy Act if income verification information is provided to the Service by lenders.
Unauthorized disclosure of tax return information can subject the Service to civil damages, undermine taxpayers’ confidence in the Service and result in reduced voluntary compliance. Taxpayers’ satisfaction with the customer service provided is reduced when they are not timely advised of the status of their requests.
Processing controls are not adequate to prevent unauthorized disclosures.
The Service is required to fill all requests for tax return information if the request is made in accordance with the Internal Revenue code (IRc) and Treasury Regulations, and as long as the disclosure will not seriously impair the federal tax administration. The IRc requires a written request before tax return information can be disclosed to a third party and allows additional requirements to be established by regulation. Treasury Regulations require that the request:
Management did not adequately perform quality review of requests before providing tax return information to third parties. Requests that were not signed by the taxpayers, did not have valid powers of attorney, or did not meet other requirements established to protect taxpayer information from improper disclosure were processed by the RAIVS function.
Transcript/Photocopy of Return Requests
Internal audit reviewed the processing of requests for tax return transcripts by preparing and submitting requests based on fictitious taxpayer accounts maintained by Inspection, and by analyzing completed taxpayer requests.
Transcript Requests Submitted by Internal Audit
We received responses to 24 invalid written requests submitted to two NER service centers. Twelve responses were received from each of the two centers. The Service made an unauthorized disclosure of tax information in eleven (46%) of the 24 requests.
One service center incorrectly released tax return transcripts for 11 of the 12 requests as follows:
The second service center in NER did not improperly release any tax return transcripts in the responses we received.
Transcript Requests Submitted by Taxpayers
One NER service center processed approximately 56% of all requests for tax return information and all disaster program requests in fiscal year 1997. Our review of 186 requests submitted by taxpayers to this service center showed that 18 (10%) tax return transcripts were released to third parties without properly completed requests. The RAIVS function did not follow written guidelines for 11 of the requests as follows:
Also, seven requests were submitted on a form developed by a third party and processed by the RAIVS function. The form included both an authorization for the Service to release tax return information to the third party, and an authorization for the third party to release income information to the Service. One of the seven requests did not contain the taxpayer’s signature on the request form, but on an attachment to the form. The Service guidelines do not adequately address the processing of requests submitted on forms that include two authorizations.
The service centers in SER and WR processed approximately 2% and 6% of all requests respectively. Our review at these service centers did not identify any problems with processing requests for tax return transcripts.
Photocopy Requests Submitted by Taxpayers
Our review of 431 requests for photocopies of tax returns showed 13 the Service incorrectly processed (3%).
Our review of 144 requests for photocopies of tax returns processed by a service center in SER showed that 12 (8%) photocopies of tax returns were released to third parties without proper authorization as follows:
At a service center in NER, our review of 134 requests for photocopies of tax returns showed one request was processed and a copy of a taxpayer return was released to a third party who did not have a valid power of attorney for the release of the information. At the WR service center we did not identify any requests that were released to a third party without proper authorization.
Without verifying the validity of the requests for copies of tax returns and/or return information, the Service can not be assured that only authorized disclosures are made. As a result, the Service can be liable for civil damages if tax return information is knowingly or negligently disclosed. The liability is $1,000, or the actual damages plus the cost of the action.
Management expressed a concern that the improper disclosure of return information occurred primarily at only one site and was not a national condition. Internal Audit considers these improper disclosures as a significant national issue because the site that incorrectly released the information processed approximately 56% of all requests for tax information and all disaster recovery program requests in fiscal year 1997.
Requirements for the release of tax return transcripts need improvement to prevent unauthorized disclosure of tax information.
Service guidelines allows the RAIVS function to conduct research to add information that is not provided by the taxpayer on the request, including the taxpayer’s Social Security Number (SSN). Individuals can obtain the tax return transcripts of a taxpayer even if they do not know the taxpayer’s SSN. The individual would only have to provide the taxpayer’s name and address and sign the request as the taxpayer.
The risk of a fraudulent signature being identified is minimal because the tax return with the taxpayer’s signature is not available to match to the signature on the request when the request is processed. Also, Service guidelines allow destruction of completed requests 45 days after the cases are closed. In contrast, the signature on the tax return can be matched to the signature on the request for a photocopy of a tax return, and these requests are maintained for six years and three months after the processing year. These issues were also raised in the Service’s Income Verification Taskforce Report dated February 7, 1997.
Using fictitious accounts maintained by Inspection to prepare requests for tax return transcripts to be sent to third parties we submitted requests signed as the taxpayers, but without taxpayers’ SSNs. We received six responses to requests sent to two NER service centers. consistent with Service guidelines, the RAIVS functions provided the tax return transcripts to the third parties in five (83%) of the six requests.
3. Management changed IRM operating procedures to require a valid TIN for all requests submitted under IRc §6103(c), in addition to taxpayer name and address.
4. Management agrees the IRS should revise all forms used for providing "written requests" to release taxpayer information to third parties under IRc §6103. They submitted a recommendation to the Assistant commissioner (Forms and Submission Processing) requesting changes to both Form 8821 ( Tax Information Authorization) and Form 4506 at the next scheduled form revision.
Taxpayer written requests for return information are not properly maintained to protect the Service from unauthorized accesses.
Service guidelines require requests submitted with remittances (photocopies of tax returns) be stored for six years and three months after the processing year. Also, requests submitted without remittances (including tax return transcripts) should be stored for 45 days after the cases are closed and then destroyed.
Neither internal audit nor the RAIVS functions could locate the Forms 4506 or other request documents to support 59 (5%) computer accesses for tax return transcripts and document requests (original tax returns, photocopies of tax returns or information from tax returns). Employees at three service centers accessed the accounts for taxpayer information. The following is a breakdown of the computer accesses that did not have supporting documents available.
Tax Return Transcript Accesses
Returns/Return Information Accesses
Service center in NER
Service center in SER
Service center in WR
Total not located
Documentation was not maintained to support the use of computer accesses for all tax return documents and transcripts. The documentation should be readily available for review and maintained in accordance with Service guidelines. Without properly maintaining documentation, the Service can not be assured that only authorized disclosure of tax return and/or return information is made.
5. We recommend that managerial reviews be conducted to ensure supporting documentation is available for all completed requests.
5. Management has written guidelines in the IRM for filing closed cases and has established review processes to ensure employees follow these guidelines.
Required letters are not consistently issued to taxpayers when their requests for tax information are not processed within 30 days.
The Service considers a final response timely if it is initiated within 30 calendar days of the received date. As a method to improve customer service, procedures were established that require an interim letter if a final response that accurately addresses all issues cannot be timely initiated. Instructions on the request inform the taxpayer that it could take up to 60 calendar days to get a copy of a tax return.
The RAIVS functions at service centers in NER and SER did not provide required interim responses to all taxpayers’ when document requests could not be timely processed. At a service center in WR, interim letters were issued for all requests for photocopies of tax returns when the requests were received in the RAIVS function.
Our review of 278 requests for photocopies of tax returns processed by two service centers (NER and SER) showed that the RAIVS functions did not timely provide interim letters to taxpayers for 122 (44%) requests which were not completed within 30 calendar days.
Our review of a sample of 144 requests for photocopies of tax returns processed at a SER service center showed that 131 (91%) requests were not completed within 30 calendar days. There was no documentation showing that interim letters had been provided for 101 (77%) of the requests. The requests required an average of 62 days to complete.
Our review of a sample of 134 requests for photocopies of tax returns processed at an NER service center showed that 21 (16%) requests were not completed within 30 calendar days. There was no documentation showing that interim letters had been provided to these taxpayers. The cases required an average of 41 days to complete.
The Service can not be assured that quality customer service is provided when established procedures to issue interim letters are not timely followed.
6. We recommend that timeliness of the issuance of interim letters be included in any quality review process established by the Service.
6. Management notified employees nationwide to use all available review processes to ensure the necessary interim letters are sent if a response cannot be sent within 30 days, and included this requirement in post review to identify processing errors.
The Service considers the safeguarding of taxpayer information a fundamental part of its mission. In fiscal year 1997, the Service processed over 1.1 million requests for tax return information. Since the Service can be held liable for unauthorized disclosure of tax information it is essential that documentation is maintained for the release of return information. The Service needs to take actions to ensure that the RAIVS functions only release tax return information based on authorized requests from taxpayers.
Also, good customer service requires taxpayers be timely advised of the status of their requests for photocopies of tax returns.
Daniel R. cappiello
Detailed Objectives and Scope
Our overall objective was to evaluate the effectiveness of the Service’s process when responding to taxpayers’ written requests for disclosing tax return information to ensure legal and procedural requirements are being met. Our specific objectives were to determine whether Service policies and controls for processing and maintaining requests ensured legal requirements were met; Integrated Data Retrieval System (IDRS) research was conducted only for valid transcript/photocopy requests to ensure taxpayer privacy; cost/benefits associated with responding to taxpayer requests ensure efficient use of resources; and assess data reliability. We also determined whether the Service identified and evaluated the legal impact of receiving information on potentially non-compliant taxpayers from third party sources.
Our audit objectives were accomplished by performing the following audit tests:
The Management Response has been removed due to its size. To see the complete Response, please go to the Adobe PDF version of this report.