A previous Inspection Service audit report titled, Review of the Selection, control and Disposition of District Examination cases, dated October 1996 (Report Reference Number 070106), reported several weaknesses in two Examination Division processing and case control systems - the Examination Returns control System (ERcS) and the Integrated Data Retrieval System (IDRS). Examination relies heavily on these two computerized systems in the case selection, control and disposition processes. When ERcS and IDRS controls are ineffective, IRS is at greater risk that employees could sell taxpayer information, harass taxpayers, conduct unauthorized examinations, or intentionally lose returns without detection. consequently, IRS risks losing the public’s confidence in its ability to protect the privacy and security of taxpayers' personal and financial information. As a result of the previous audit, the IRS commissioner reported Examination case Assignment and Inventory controls, which included ERcS, as a material weakness to the Department of the Treasury for the 1997 Federal Managers Financial Integrity Act (FMFIA) reporting. ERcS continued as an FMFIA material weakness in 1998.

The objectives of our review were to determine if the IRS had taken corrective actions on the issues presented in the October 1996 report and to determine if those actions were effective.

IRS took corrective actions to improve ERcS controls. The improved controls reduced the risk of inappropriate actions on the approximately 1.7 million examinations closed during Fiscal Year 1998.

However, corrective actions were not effective in the following areas:

• ERcS has not received a security certification as required by government guidelines. The chief Information Officer (cIO) did not ensure the certification was completed timely.
• ****2d,2e****
• ERcS does not prevent acting managers from approving actions on their own inventories. This condition exists because developers in the cIO’s Office misinterpreted Examination’s requirements.
• Examination management did not adequately limit examiners' IDRS capabilities to order tax returns and to establish, update and close examination records. The memorandum from the Assistant commissioner (Examination) prohibiting examiners and managers from having these capabilities was not followed by Operations.
• Examination personnel were not analyzing cases closed due to errors or unlocatable returns to identify and quantify errors, procedural deficiencies, or integrity situations. The instructions provided by Examination management did not specifically address how or what information needed to be analyzed.

IRS needs to take additional actions to enhance the effectiveness of Examination controls and provide further protection of taxpayer rights and tax return data. Information Systems and Examination management can reduce the risk associated with the Examination Division’s use of ERcS and IDRS by effectively implementing the following recommendations.

The Assistant commissioner (Examination) should request the cIO to:

• Develop a process to convert the audit trail files to a format that can be used by external users.
• capture the Social Security Number of each ERcS user and the accesses made in the audit trail.
• Prevent acting managers from having the ability to approve any changes to their inventory.

The Assistant commissioner (Examination) needs to direct district management to: remove examiners’ capabilities to order tax returns and to establish, update, and close examination records; review IDRS usage reports; and ensure field offices monitor and report the results of their analyses of case closures due to errors or unlocatable returns.

The cIO must ensure the system security certification process for ERcS is completed. The cIO must also develop and implement a process for reviewing ERcS user activities, and ensure the ERcS audit trail can be provided to external users in a searchable format. Additionally, Examination and Information Systems need to work cooperatively to improve the effectiveness of ERcS.

Management’s Response: The chief Operations Officer and cIO agreed with our recommendations and have agreed to take corrective actions. Management's comments have been incorporated into the report where appropriate and the full text of their comments is included as Appendix V.

2d = Law Enforcement Technique(s)
2e = Law Enforcement Procedure(s)