Improvements Are Needed to Ensure Control and Accountability Over Automated Data Processing Assets
September 2000
Reference Number: 2000-10-145
This report has cleared the Treasury Inspector General for Tax Administration disclosure review process and information determined to be restricted from public release has been redacted from this document.
September 14, 2000
MEMORANDUM FOR COMMISSIONER ROSSOTTI
FROM: Pamela J. Gardiner /s/ Pamela J. Gardiner
Deputy Inspector General for Audit
SUBJECT: Final Audit Report - Improvements Are Needed to Ensure Control and Accountability Over Automated Data Processing Assets
This report presents the results of our review of Controls and Accountability Over Automated Data Processing (ADP) Assets. The objective of the review was to determine the effectiveness of Internal Revenue Service (IRS) efforts to properly control and account for its ADP assets. In summary, we found that the IRS has taken aggressive steps to improve management of its ADP equipment.
We recommended that the IRS verify the results of its inventory reconciliation process prior to forwarding ADP Certifications to the Commissioner and fully implement the Single Point Inventory Function to ensure the accuracy of the inventory and to minimize the risk of continued criticism of its financial records. IRS management agreed to the recommendations presented in this report and has developed an implementation schedule for its corrective actions. Management’s comments have been incorporated into the report where appropriate, and the full text of their response is included as an appendix.
Copies of this report are also being sent to the IRS managers who are affected by the report recommendations. Please contact me at (202) 622-6510 if you have questions, or your staff may call Maurice S. Moody, Associate Inspector General for Audit (Headquarters Operations and Exempt Organizations Programs), at (202) 622-8500.
Appendix I – Detailed Objective, Scope, and Methodology
Appendix II – Major Contributors to This Report
Appendix III – Report Distribution List
Appendix IV – Management’s Response to the Draft Report
The Internal Revenue Service (IRS) has had longstanding problems with its systems and controls over property and equipment, including information systems assets. The IRS has taken action to address these problems. The Commissioner designated the Chief Information Officer (CIO) as the executive responsible for controlling and accounting for all Automated Data Processing (ADP) equipment and software. The CIO directed that an all-out effort was needed to bring the accuracy of the inventory up to acceptable levels. A wall-to-wall physical ("floor to system") inventory was conducted for selected sites at a cost of approximately $7.6 million. The CIO also directed that full-time property management staffs be established in all offices using a new set of inventory procedures that employ a Single Point Inventory Function (SPIF) under the exclusive management and control of the Information Systems function.
The overall objective of this review was to determine the effectiveness of IRS efforts to properly control and account for ADP assets.
Results
The IRS Wall-to-Wall Inventory/Reconciliation Process conducted by teams of IRS employees and contractors was a positive initiative to account for ADP equipment and was vital to ensuring that all critical systems were identified and made Year 2000 compliant. The development of the SPIF guidelines and procedures, and their proper implementation and execution, will further rectify weaknesses in the current ADP inventory management system.
While the IRS has made progress in controlling and accounting for ADP assets, additional actions are needed. ADP Property Certifications should be verified to ensure the accuracy and completeness of the inventory and reconciliation process prior to final approval and submission to the CIO and Commissioner. Adequate resources should be dedicated to ensure successful implementation of the SPIF, and SPIF operating procedures should specifically address internal use software developed by the IRS and annual physical inventory issues. Without these actions, the inventory will continue to be inaccurate, and the IRS will be at risk of continued criticism of its financial records. Also, the IRS may, once again, have to incur significant costs for a comprehensive verification of ADP equipment in Fiscal Year (FY) 2000.
Verification of the Automated Data Processing Property Certifications Is Needed to Ensure the Accuracy and Completeness of the Inventory for the Chief Information Officer
The Information Systems Operations Division is not properly verifying the ADP Property Certifications prior to forwarding them to the CIO for final approval and certification to the Commissioner. The IRS deployed teams of employees and contractors to conduct a comprehensive "floor to system" inventory at 46 field sites and several National Headquarters buildings. By December 1999, inventories were completed at 32 sites. Upon completion of the inventory, the teams provided each site with an exception list of equipment that they could not locate. The sites certified to their executive head of office that the exceptions were resolved and that their hardware and software inventory was complete and accurate. However, we reviewed nine sites and found that only three maintained documentation to support their resolution actions. Also, queries of the inventory database for the 9 sites showed that 8,002 inventory records were not updated as required. Quality review was not performed to ensure that the sites properly updated the inventory records. As a result, the site Certifications cannot be relied upon, thus jeopardizing the completeness and accuracy of the inventory database.
Adequate Resources Need to Be Dedicated to Ensure the Successful Implementation of the Single Point Inventory Function
Adequate resources have not been dedicated to the SPIF implementation process. The CIO has directed the establishment of full-time ADP property management units in all offices. The Asset Management Modernization Project Office, which is responsible for nationwide implementation of the SPIF, believes that the unit should consist of six staff at the outset for the SPIF to succeed. However, the SPIF is being implemented with varying configurations at different sites. For example, at one Computing Center five employees and one manager are assigned, while at the District Offices only one person per District is being assigned. Without providing adequate resources to maintain the inventory, the IRS will not be able to sustain the progress made during the inventory and reconciliation processes used to support the accountability and financial reporting of ADP assets.
The Single Point Inventory Function Standard Operating Procedures Should Include Specific Instructions That Address Additional Software and Annual Inventory Issues
The SPIF Standard Operating Procedures (SOP) do not address application programs or systems and internal use software maintained by the IRS. Statement of Federal Financial Accounting Standards (SFFAS) No. 10, effective October 1, 2000, requires identification and capitalization of internal use software. SPIF procedures have not been updated to include how to properly identify and account for internal use software, thus risking the IRS’ compliance with SFFAS No. 10. Also, the SOPs do not include specific instructions on the consistent preparation and maintenance of documentation of physical inventories. Although the SPIF SOPs state that documentation plays a major role in control over ADP property management, they do not specify what documentation should be maintained, by whom, where, and for how long. Without adequate documentation for the annual inventory reconciliation of its ADP property, the IRS cannot be assured of the accuracy and completeness of its inventory or the Certifications forwarded to the Commissioner.
Summary of Recommendations
The Director, Enterprise Operations, should verify the ADP Certifications prior to their submission to the CIO for final approval and certification to the Commissioner. The CIO, together with other affected senior executives, should re-evaluate resource commitments needed to successfully implement the SPIF, and oversight of the SPIF should be centralized. The SPIF SOPs need to be updated to ensure that SFFAS No. 10 requirements for the identification and capitalization of internal use software are met. Also, the SOPs need to be updated to include specific requirements for maintaining documentation relating to the annual inventories to ensure that the Certifications forwarded to the Commissioner are accurate.
Management’s Response: The Director, Enterprise Operations, will revise the annual inventory process to include quality reviews of all IRS sites beginning with the FY 2001 Certification. The revised procedures will be piloted and implemented as an update to the Internal Revenue Manual. The Director, Enterprise Operations, will perform a pilot of the District Office SPIF to determine the exact number of employees required to successfully implement the SPIF. The Director, Enterprise Operations, centralized oversight of the SPIF implementation under the Asset Management Modernization Project Office. When it becomes operational, the Enterprise Systems and Asset Management Division will assume oversight responsibility. The Director, Enterprise Operations, will determine the appropriate location for the accountability and identification of internal use software SOPs. The Director, Systems Development, will be accountable for implementing and integrating an action to update the SOPs.
Management’s complete response to the draft report is included as Appendix IV.
The overall objective of the audit was to determine the effectiveness of Internal Revenue Service (IRS) efforts to properly control and account for Automated Data Processing (ADP) assets. The audit evaluated the IRS’ endeavors to ensure the completeness and accuracy of the Integrated Network and Operations Management System (INOMS) for controlling and managing ADP property.
We reviewed the IRS Wall-to-Wall Inventory/Reconciliation Process. Our review focused on the ADP Property Certifications for inventories completed at nine sites between August 2, 1999, and December 10, 1999. We verified the completeness checks of the Application Program Registry (APR) Re-certifications and Fiscal Year (FY) 1999 ADP Certifications for the IRS sites that did not participate in the Wall-to-Wall Inventory/Reconciliation Process. We also evaluated the initial implementation of the Single Point Inventory Function (SPIF). The audit work was performed from December 1999 through March 2000 at the Information Systems Operations Office in New Carrollton, Maryland. This audit was performed in accordance with Government Auditing Standards.
Details of our audit objective, scope, and methodology are presented in Appendix I. Major contributors to this report are listed in Appendix II.
The IRS has a history of problems in controlling and accounting for its ADP property. Audits conducted by various outside agencies, as well as internal reviews, revealed a failure by the IRS to maintain a complete and accurate ADP inventory.
The IRS uses the INOMS as a tool to control its ADP property. The INOMS provides a real-time, centralized database of all ADP hardware and software used throughout the IRS.
The IRS defines ADP property as:
The IRS reported a net book value for property and equipment, including ADP assets, of approximately $1.3 billion in the FY 1999 financial statements. Although the General Accounting Office (GAO) acknowledged that the IRS property and equipment (P&E) balance at the end of FY 1999 was reasonable, the GAO identified material weaknesses in internal controls over P&E.
In almost all audits, internal and external, the lack of an organization solely dedicated to ADP property management was recognized as a significant factor contributing to the poor condition of the property asset records. In response to a Treasury Inspector General for Tax Administration report entitled The Internal Revenue Service Needs to Significantly Improve the Inventory Used to Monitor Its Year 2000 Conversion Efforts (Reference Number 2000-20-021, dated December 1999), the IRS is taking the following actions:
Also, the Acting Chief Financial Officer, the CIO, and the Chief, Agency-Wide Shared Services, entered into a Memorandum of Understanding (MOU) in February 2000. The MOU defines the responsibilities of the three organizations for maintaining control over capital assets.
The IRS has taken aggressive steps to improve management of its ADP assets. For example, the Wall-to-Wall Inventory/Reconciliation Process was a positive initiative to properly account for ADP equipment. On August 2, 1999, the Director, Enterprise Operations (formerly Assistant Commissioner for National Office Operations), deployed teams of IRS employees and contractors to conduct comprehensive inventories of computer hardware and software at 46 sites and several National Headquarters buildings. By December 1999, the National Headquarters Wall-to-Wall Inventory teams had completed the inventories at 32 sites and updated the inventory records for 290,782 (36 percent) of the IRS’ 800,000 ADP assets. The 32 sites included all 10 IRS Centers and
3 Computing Centers, 11 of the larger District Offices, and 8 other offices. In addition, the Century Date Change Project Office directed that all organizations re-certify their internal use software to be accurate and complete on the INOMS APR.
The SPIF process will establish clear accountability in the receipt, distribution, and disposal of ADP property at all IRS sites. The development of the SPIF guidelines, and the proper implementation and execution of the procedures, will further rectify weaknesses in the current ADP inventory management system.
While the IRS has made substantial progress to ensure control and accountability over ADP assets, we identified the following opportunities for further improvements. Specifically:
Verification of the Automated Data Processing Property Certifications Is Needed to Ensure the Accuracy and Completeness of the Inventory for the Chief Information Officer
The Information Systems Operations Division is not properly verifying the ADP Property Certifications prior to forwarding them to the CIO for final approval and certification to the Commissioner. The IRS invested over $7.6 million to conduct the Wall-to-Wall Inventory/Reconciliation Process at various sites. The CIO directed this aggressive effort to address the Year 2000 threat and the chronic failure to maintain controls.
The SOPs outline a 3-level certification methodology that ensures a complete and accurate inventory of all ADP hardware and software. The objective is to update all the records on the ADP inventory database. Each National Headquarters Wall-to-Wall Inventory team leader certifies the results of the physical "floor to system" inventory and provides to the site official an exception list of equipment that he/she could not find. The site official has 30 days to certify to the responsible executive that all the exceptions are resolved. The Director, Enterprise Operations, will package all of the sites’ Certifications and forward them to the CIO for final approval and certification to the Commissioner.
We judgmentally selected nine sites and reviewed their Certifications and available documentation. All of the sites agreed with the exceptions identified by the National Headquarters team and certified to their executive that their hardware and software inventory was complete and accurate. However, only three sites provided documentation to support their resolution of the exceptions found by the National Headquarters Wall-to-Wall Inventory team.
We judgmentally selected two of the six sites that did not substantiate their Certifications and examined their files.
We also queried the inventory database for the nine sites reviewed to determine whether all of the records were updated as required by the wall-to-wall SOPs. For the 9 sites reviewed, we identified 8,002 inventory records requiring update. We found that 5,416 of the 8,002 records were for software that should have been mass-updated but was inadvertently overlooked. We brought this to the attention of the site team leader who agreed and took immediate corrective action. The remaining 2,586 records were not updated by the sites.
The SOPs do not provide quality assurance guidance to verify that the sites completely and accurately resolved the exceptions identified by the National Headquarters Inventory teams. The Information Systems Transmittal and Control Branch did not plan to conduct quality reviews prior to sending the ADP Property Certifications through the Director, Enterprise Operations, to the CIO. On March 29, 2000, we met with the Transmittal and Control Branch to provide the results of our review and present our recommendations. On March 31, 2000, the Transmittal and Control Branch Chief advised the Director, Enterprise Operations, of our results and recommended that quality review work be performed before forwarding the ADP Certifications to the CIO.
By conducting a quality review, the CIO will reduce the risk of sending the Commissioner a Certification that is inaccurate and incomplete. Also, the cost of future inventory updates may be reduced through lessons learned from the quality review.
Recommendation
Management’s Response: IRS management agreed with our recommendation. The Director, Enterprise Operations, will revise the annual inventory process to include quality reviews of all IRS sites beginning with the FY 2001 Certification. The revised procedures will be piloted, implemented and provided as an update to the Internal Revenue Manual section for Assets Management.
Adequate Resources Need to Be Dedicated to Ensure the Successful Implementation of the Single Point Inventory Function
Adequate resources have not been provided to ensure the success of the SPIF. The CIO is the official responsible for ownership, management, and control of all ADP property in the IRS. The CIO directed the Information Systems staff to establish full-time property management staffs in all offices.
The SPIF was developed to help the CIO fulfill his duties as owner and manager of ADP assets. The SPIF centralizes ADP property management in the Information Systems organization. The AMM Project Office is responsible for implementing the SPIF nationwide, as part of the asset management modernization program.
SPIF guidelines specify that each IRS Center, Computing Center, and District Office develop a single unit of responsibility for the management and control of all ADP property. The unit should consist of an ADP property manager, a clerical specialist, and inventory specialists. The general consensus of the AMM Project Office personnel is that each SPIF unit should consist of 6 employees and the grade structure of the unit should range from grades 7 through 12.
Through March 2000, the SPIF was implemented at four IRS Centers and one Computing Center. The Directors, Enterprise Operations, Service Center Operations, and Information Systems Field Operations, are implementing the SPIF differently at the three types of IRS sites. At the IRS Centers and Computing Center, the SPIF teams consists of six employees, while only one employee per District will be assigned to the SPIF.
Each District employs 8 to 10 people in the Information Systems Division, and the Districts cannot afford to dedicate 6 of those people to the SPIF. However, the AMM Project Office stated that one person cannot successfully perform all SPIF duties. This is especially true in large Districts that span a large geographic area. In addition, implementation of the SPIF at the Districts will not be completed until 2001. The Deputy CIO, Operations, could not provide additional funds to the Directors, Enterprise Operations, Service Center Operations and Information Systems Field Operations, for the SPIF because of the need to fund other high priority projects. Without timely and fully implementing the SPIF, the IRS will continue to face ADP inventory control and management problems.
Recommendations
Management’s Response: IRS management agreed with our recommendation. The Director, Enterprise Operations, will perform a pilot of the District Office SPIF to determine the exact number of employees required to successfully implement the SPIF.
Management’s Response: IRS management agreed with our recommendation. The Director, Enterprise Operations, centralized oversight of the SPIF implementation under the AMM Project Office. When it becomes fully operational, the Enterprise Systems and Asset Management Division will assume oversight responsibility.
The Single Point Inventory Function Standard Operating Procedures Should Include Specific Instructions That Address Additional Software and Annual Inventory Issues
The SPIF SOPs should include procedures that address:
Application programs or systems and IRS internal use software
The SPIF SOPs do not address application programs or systems and internal use software developed/maintained by the IRS but may be added at a later date. The APR is a module within the INOMS that contains information about all application programs or systems and internal use software developed/maintained by the IRS.
Statement of Federal Financial Accounting Standards (SFFAS) No. 10, effective October 1, 2000, requires the identification and capitalization of internal use software. An MOU signed in February 2000 does address the need to develop and implement a methodology for identifying and capitalizing expenditures for internal use software in accordance with SFFAS No. 10. The Chief, Agency-Wide Shared Services, Acting Chief Financial Officer, and the CIO concurred with the MOU.
Although the MOU was agreed to in February 2000, it has not been implemented and the SPIF procedures do not address the APR. Without proper accountability and identification of its internal use software, the IRS will not be able to properly value the software and comply with SFFAS No. 10.
Documentation of annual physical inventories
The SPIF SOPs do not specify what documentation should be maintained, by whom, where, and for how long. The procedures state that documentation plays a major role in ADP property management and should be collected and maintained throughout the inventory process. The SOPs further state that documentation will also be secured and stored as a historical record for the site’s inventory function.
Without adequate documentation for the annual physical inventory and reconciliation of its ADP property, the IRS cannot be assured of the accuracy and completeness of its inventory and ensure the accuracy and completeness of the Certifications of ADP Property.
Recommendation
Management’s Response: IRS management agreed with our recommendation. The Director, Enterprise Operations, will determine the appropriate location for the accountability and identification of internal use software SOPs. The Director, Systems Development, will be accountable for updating the SOPs.
The IRS has taken aggressive steps to improve management of its ADP assets. The IRS Wall-to-Wall Inventory/Reconciliation Process was a positive initiative to properly account for ADP equipment. The SPIF guidelines and procedures, properly implemented and executed, will further rectify weaknesses in the current ADP inventory management system. However, without verifying the inventory/reconciliation results and fully implementing the SPIF, the IRS will be at risk of a continued inaccurate inventory of ADP assets. Also, the IRS may, once again, have to incur significant costs for a comprehensive verification of ADP equipment in FY 2000.
Appendix I
Detailed Objective, Scope, and MethodologyThe overall objective was to determine the effectiveness of Internal Revenue Service (IRS) efforts to properly control and account for Automated Data Processing (ADP) assets. The audit evaluated IRS efforts to ensure the accuracy of the Integrated Network and Operations Management System (INOMS) for controlling and managing ADP property and equipment. The following steps were conducted to accomplish the audit objectives:
I. To determine the effectiveness of IRS efforts to ensure the accuracy of the INOMS for controlling ADP property and equipment, we:
II. To determine the effectiveness of IRS efforts to ensure the accuracy of the INOMS for managing ADP property and equipment, we:
Appendix II
Major Contributors to This ReportMaurice S. Moody, Associate Inspector General for Audit (Headquarters Operations and Exempt Organizations Programs)
John R. Wright, Director
Daniel R. Cappiello, Audit Manager
Joan R. Floyd, Senior Auditor
Pillai Sittampalam, Senior Auditor
Rosemarie M. Maribello, Auditor
Appendix III
Report Distribution ListDeputy Commissioner Operations C:DO
Chief Financial Officer CFO
Chief Information Officer IS
Deputy Chief Information Officer, Operations IS
Director, Enterprise Operations IS:E
Director, Information Systems Field Operations IS:F
Director, Information Systems Service Center Operations IS:SC
Chief, Office of Information Systems Program Oversight IS:IR:O
National Taxpayer Advocate C:TA
Office of the Chief Counsel CC
Office of Management Controls CFO:A:M
Director, Legislative Affairs CL:LA
Director, Office of Program Evaluation and Risk Analysis M:O
Appendix IV
Management’s Response to the Draft ReportThe response was removed due to its size. To see the complete response, please go to the Adobe PDF version of the report on the TIGTA Public Web Page.