The Internal Revenue Service (IRS) is in the process of consolidating the mainframe computer operations used to process tax data. The consolidation involves moving mainframe processing from the IRS’ 10 service centers into new mainframe computers located in 2 computing centers—the Tennessee Computing Center (TCC) and the Martinsburg Computing Center (MCC). A successful mainframe consolidation effort is critical since the IRS must rely on these systems each year to process tax returns and to assist taxpayers by providing answers to questions about their tax accounts.

This is our third audit of the Service Center Mainframe Consolidation (SCMC) Project. The second audit, The Service Center Mainframe Consolidation Project Has Made Significant Progress, But Project Execution and Administration Risks Remain (Reference Number 199920068, dated September 1999) reported that: (1) critical risks related to SCMC remain unresolved, (2) controls over technical aspects of contract administration remain inadequate, and (3) staffing costs of consolidation were not accurately budgeted, captured, and reported.

The overall objective of our current review was to determine whether SCMC project management controls are adequate to ensure that continuing service center consolidations are successful. In addition, we evaluated some of the corrective actions taken as a result of the prior audit.

The IRS has made significant progress in ensuring the computing and service centers’ readiness for consolidation and in minimizing any effect on operations and taxpayers. The SCMC Project Office has initiated process improvements identified during the initial service center consolidations and established risk management activities. In addition, the computing centers have conducted extensive recruiting efforts to mitigate staffing shortages. However, unresolved risks may impact successful consolidation of mainframe computer operations for the remaining five service centers.

Since the initial migrations of service center processing to the computing centers, there have been multiple instances when some components of the consolidated mainframe computer environment have experienced capacity related problems and could not process the workload effectively. Senior IRS management has been tracking the capacity issue since December 1998 and recently recommended the creation of a separate committee to identify and recommend solutions to outstanding issues.

During June 13-17, 1999, the Capacity Management Branch of the Systems Support Division (SSD) performed a capacity analysis of a segment of the consolidated computer environment. The SSD report included several recommendations to improve system performance and stated that additional performance testing is required to ensure that sufficient capacity is provided to ensure that each computing center can handle a five service center configuration. Although the SCMC Project Office, in conjunction with other IRS organizations and contractors, has closely analyzed problems and has taken measures to address concerns with system performance, additional testing has not been performed to establish that computing centers can support the workload of five service centers.

The capacity issue could also affect the capability of the IRS to implement planned disaster recovery activities, as each computing center was supposed to be able to process 70 percent of the workload from the other computing center in case of a disaster.

Without conducting additional performance testing, including disaster recovery capability, management cannot be assured that the consolidated mainframe environment has sufficient computer capacity for timely tax return processing.

The General Accounting Office’s Standards for Internal Control in the Federal Government identifies two types of information system controls. Application controls, one of the control types, help ensure completeness, accuracy, authorization, and validity of all transactions during application processing. Application controls are also installed where data is transferred from one system to another system to ensure that all inputs are received and are valid, and outputs are correct and properly distributed. In our September 1999 audit, we reported application control weaknesses.

To address the control deficiencies, IRS management requested computer programming changes to automate the run-to-run balancing process and began developing the Output Tracking System (OTS) to track files transferred between the service centers and computing centers. However, with 5 of the 10 service centers consolidated, these control initiatives are not complete and may not be completed before the remaining consolidations are implemented. Additional service center consolidations increase the risk of incomplete or inaccurate tax return processing that could result in untimely or erroneous notices to taxpayers.

The OTS development efforts indicate that the SCMC Project Office did not always adhere to IRS standards. For example, OTS test results were not forwarded to the Office of Security, Evaluation, and Oversight for an independent review and approval before pilot implementation. In addition, the SCMC Project Office did not obtain proper approval to operate the OTS pilot in the production environment.

System development efforts that do not follow prescribed policies and procedures could result in new systems negatively affecting system processing or potentially creating security weaknesses in the production environment.

The Chief Information Officer (CIO) should ensure that additional performance testing establishes that the consolidated mainframe environment can support the workload of five service centers, including disaster recovery processing requirements. The CIO should also ensure that adequate processing controls are in place for automated balancing and file tracking processes prior to SCMC Project completion and that the OTS development efforts follow established IRS system development procedures.

Management’s Response: We issued a draft of this report to IRS management on April 7, 2000, with a May 8, 2000, response period. However, management’s response was not available as of the date this report was released.