The Internal Revenue Service (IRS) has not ensured that access to government credit cards and computer systems is timely canceled when employees leave the IRS’ employment. A prior audit report, Assessment of Controls Over the Employee Clearance Process (Reference Number 082102, dated January 26, 1998), outlined similar control weaknesses. When an employee leaves, the IRS needs to take prompt actions to ensure government credit cards are canceled and computer system accesses are removed. These actions are part of a clearance process for employees when they leave IRS employment.

The IRS currently employs over 100,000 people. Half of the IRS employees have access to the computer system containing taxpayer information and about one-third of the employees have government credit cards. Approximately 34,000 employees have left the IRS’ employment since issuance of the prior audit report. About one-fifth of these employees were temporarily hired by the IRS to process income tax returns and may or may not be rehired in subsequent years.

This audit was initiated to follow up on corrective actions for the conditions identified in the prior audit. We determined whether actions had been taken to strengthen process controls and if they were effective in ensuring that when employees left the IRS’ employment, prompt action was taken to terminate their access to government credit cards and computer systems. Additionally, we assessed the re-engineered process that was being piloted in the New Jersey District and the Philadelphia Service Center.

Since issuance of the prior audit report, the Director, Personnel Division has implemented interim and long-term corrective actions to strengthen the controls over the clearance process. The Director designated clearance coordinators, issued a manager’s checklist, and, for the long-term, initiated plans to re-engineer the entire process. In 1998, the IRS’ Senior Council for Management Controls recognized the clearance process as a significant control deficiency and began monitoring the actions planned to improve the controls.

The actions taken to date to address control deficiencies in the employee clearance process have not ensured that the risks from financial loss and access to or destruction of taxpayer data have been sufficiently reduced.

Interim changes to controls over the clearance process did not ensure that functional coordinators took action when employees left the IRS. Although clearance coordinators were named to ensure actions were taken and a manager’s checklist was issued, these actions were not effective. In 4 districts, functional coordinators had not timely canceled travel cards in 81 percent of the employee clearances reviewed and had not timely canceled computer passwords in 48 percent of the employee clearances reviewed.

The IRS piloted the re-engineered clearance procedures at the New Jersey District and the Philadelphia Service Center beginning in July 1999. However, the re-engineered clearance procedures did not ensure former IRS employees’ access to government credit cards and computers was timely canceled during the pilot. The re-engineered guidelines did not require some of the separation actions to be initiated until after the employees left the IRS. At the service center, computer system passwords during the pilot were canceled an average of nine days after separation. At the district, government credit cards assigned to 2 former employees had not been canceled although the employees had left the IRS 28 and 56 days, respectively, prior to the time of this audit. The omissions occurred because the IRS had not effectively monitored the pilot.

The Chief, Agency-Wide Shared Services and the Chief, Management and Finance should provide clearance coordinators with specific interim roles and responsibilities for ensuring former employees’ access to government credit cards and computer systems is timely canceled. Also, the re-engineered clearance procedures should be revised to prevent systemic delays during the clearance process. The interim and re-engineered clearance processes should be monitored to ensure they are effective.

Management’s Response: IRS management agreed to the continued need for improvement after the pilot process. The IRS will use the Totally Automated Personnel System (TAPS) separated employee listing, which can be generated daily, to initiate and monitor clearance actions. The Agency-Wide Shared Services Office of Personnel/Payroll Systems will work with Finance and Information Systems to set up procedures for using TAPS information to timely cancel credit cards and passwords. It will also issue instructions detailing a streamlined process for canceling government credit cards, phone cards, and computer passwords. Clearance coordinators will monitor the process through daily TAPS listings.