Executive Summary

Objectives and Scope

Background

Results

Conclusion

Appendix I – Detailed Objectives, Scope, and Methodology

Appendix II – Major Contributors to This Report

Appendix III – Report Distribution List

Appendix IV – Management’s Response

Executive Summary

A photocopy user fee is the fee that is paid to the Internal Revenue Service (IRS) for providing a taxpayer with a copy of their tax return. Taxpayers prepay the fee of $23 for each tax return photocopy requested when submitting a Request for Copy or Transcript of Tax Form (Form 4506). The fee is refunded to the taxpayer if the IRS later determines that it cannot provide a photocopy of the requested tax return.

This review was conducted at the Memphis Service Center (MSC) in part because of concerns that photocopy user fee payments could result in fraudulent refunds. We evaluated controls over photocopy user fee refunds and determined whether material fraud had occurred. This included evaluating whether photocopy user fee refunds had been properly recorded and accounted for, whether refunds were adequately supported and properly approved, and whether cancelled refunds were properly resolved. We also evaluated various inventory controls, and determined whether appropriate actions had been taken to timely provide taxpayers with photocopies of tax returns.

While we did not find indications of IRS employees embezzling photocopy user fee refunds, we did find that controls over these fees were not adequate to help prevent the opportunity for improper activity. In addition to these control weaknesses, we also determined that taxpayers did not always receive timely and complete responses to their requests for tax return photocopies. Specifically, we found the following.

• MSC did not have adequate input, approval, and certification controls over photocopy user fee refunds. Management did not ensure that adequate controls existed over the process to input, approve, and certify photocopy user fee refunds. Weaknesses were found in the access provided to the database used to input the refunds, in the separation of duties between authorizing and inputting refunds to the system, and in the review and approval process used to certify the refunds by management. Additionally, the database used to control photocopy user fees does not always provide an accurate audit trail for refunds issued, and some documents required to authenticate refunds could not be located.
• MSC did not perform adequate preprocessing of Forms 4506. Employees did not always identify and reject unprocessable Requests for Copy or Transcript of Tax Forms (Forms 4506). In addition, Photocopy Unit personnel disclosed four taxpayers’ tax return information to unauthorized third party requestors.
• MSC did not always take adequate actions to secure requested tax returns. Photocopy Unit personnel did not locate 13 of 26 returns which should have been available. The employees also did not always document follow-up actions when their initial requests did not produce the returns but information received or a lack of response to the request indicated that follow-up would be appropriate.
• MSC did not have adequate inventory controls over photocopy user fee cases. Photocopy requests that resulted in refunds were frequently not controlled and processed timely. In addition, Photocopy Unit personnel generally did not issue subsequent interim letters to inform taxpayers when to expect a response if the response was delayed longer than expected.
• MSC did not have adequate controls over cancelled photocopy user fee refund checks. MSC did not properly research and resolve cancelled refund checks. In addition, the Accounting Branch did not properly record cancelled photocopy refund checks in the General Ledger.

Management’s Response: During this review, we issued a memorandum to IRS management addressing each of the conditions included in this report. MSC IRS management agreed with all of the findings we identified in our review. Management’s complete response is included as Appendix IV.

Objectives and Scope

This review was conducted at the Memphis Service Center (MSC) in part because of concerns that photocopy user fee payments could result in fraudulent refunds. Our objectives were to evaluate controls over photocopy user fee refunds and determine whether material fraud had occurred. This included evaluating whether photocopy user fee refunds had been properly recorded and accounted for, whether refunds were adequately supported and properly approved, and whether cancelled refund checks were properly resolved. We also evaluated various inventory controls, and determined whether appropriate actions had been taken to timely provide taxpayers with photocopies of tax returns. We conducted the review during the period September 1998 to February 1999.

Details of our audit objectives, scope, and methodology are presented in Appendix I. Major contributors to this report are listed in Appendix II.

Background

Taxpayers submit Requests for Copy or Transcript of Tax Form (Form 4506) to request copies of tax returns from the Internal Revenue Service (IRS). The photocopy user fee is $23 for each tax return (tax period) requested. The Taxpayer Relations Branch, Photocopy Unit controls and processes Forms 4506.

Photocopy Unit personnel manually refund photocopy user fees when the Internal Revenue Service (IRS) cannot fulfill requests. In Fiscal Year 1998, the Memphis Service Center (MSC) refunded 47 percent of the photocopy user fees deposited.

Results

Our review showed that the MSC could improve processing procedures and controls over photocopy requests, which should improve customer service and reduce the percentage of photocopy user fees which must be refunded. In some cases, available returns were not located and responses to taxpayers were not timely. Also, MSC personnel did not always properly record and account for photocopy user fee refunds. Although we did not find any indications of employee fraud, controls were not effective to help prevent opportunities for improper activity. Specifically, we identified the following problems.

• Memphis Service Center did not have adequate input, approval, and certification controls over photocopy user fee refunds.
• Memphis Service Center did not perform adequate preprocessing of Forms 4506.
• Memphis Service Center did not always take adequate actions to secure requested tax returns.
• Memphis Service Center did not have adequate inventory controls over photocopy user fee cases.
• Memphis Service Center did not have adequate controls over cancelled photocopy user fee refund checks.

Memphis Service Center Did Not Have Adequate Input, Approval, and Certification Controls Over Photocopy User Fee Refunds

We identified problems with the controls over the input, approval, and certification of photocopy user fee refunds. Specifically, we found the following.

• Inadequate database access controls.
• Inadequate separation of duties.
• Inadequate audit trail for refunds issued.
• Inadequate documentation for refunds issued.
• Inadequate review, approval, and certification procedures.
• Inadequate quality review of photocopy user fee cases.

Photocopy Unit personnel use the Photocopy Refund System (PRS) to input, manage, and control the refunds. The PRS was locally developed and is maintained by MSC personnel. Employees who input, review, and approve refunds are provided password access to the PRS. Access privileges should be deleted when employees leave the function or otherwise do not need to access the database.

Information System Security guidelines require user function managers to notify security personnel when users no longer need access to a system. In addition, the system should detect when a user has not accessed the system for specified periods and disable or delete their access privileges.

However, we determined that former employees could still access the PRS database, create and change records, and restructure database files. We identified 21 former Photocopy Unit and other employees and one former manager who could still access the PRS database. Each of the 22 individuals no longer needed access, yet still had permission to create and change refund records. The former manager also had full access permission to delete records and restructure the files.

Our tests demonstrated that these employees could login to the system, and use another active Photocopy Unit employee’s number to input refund transactions. When we brought this matter to her attention, the current Photocopy Unit manager promptly requested all 22 be removed from the system.

Our review showed the following causes for the unauthorized access problem.

• Managers had not prepared Automated Information System User Registration/Change Requests (Forms 5081) to request Information Systems to delete employees' access privileges to the mini-computer or to the PRS database.
• Managers had not annually certified that system access for each employee was reviewed and was appropriate.
• The MSC mid-range computer that hosts the PRS is not programmed to disable or delete nonusers’ access privileges timely, or to require employees to change their passwords at least every six months.
• The PRS design allows an employee to input another employee's number when creating a refund record, possibly without detection.

Management’s Response: Management agreed with this finding, and has corrected these deficiencies. Management is monitoring to ensure that system access is promptly removed when employees are reassigned or detailed to another position. Annual certifications have been completed and will continue to be completed per Internal Revenue Manual (IRM) guidelines. The PRS database is a local program that will be replaced with a National Standard Application (NSA) by January 1, 2000. Interim system changes are being implemented to enhance the security of the program.

Office of Audit Comment: The Directors should discuss with applicable IRS National Office management whether the NSA meets proper security requirements and corrects the problems identified in this report.

Managers' and Quality Assurance employees' access privileges violated the separation of duties control standard. This control standard provides that the same person must not have the authority to create, review, and approve the same transaction. In addition, permission to delete records and restructure database files should be restricted to personnel who do not have permission to create and change refund records.

However, we noted the following problems regarding appropriate separation of duties in the Photocopy Unit.

• The Photocopy Unit Lead employee had full access to the open and archived records, which permitted her to add, change, and delete records and to restructure the database files. The Lead input 260 refund records during our audit period. When we started the audit, she also was responsible for reviewing most refunds entered on the system.
• The Photocopy Unit manager, Correspondence Section Chief, and the assigned quality reviewer could add and change refund records. The Photocopy Unit manager reviewed and approved refund records. The Section Chief signed the weekly Final Photocopy Refund List as the authorizing official. (Note: We queried the database and did not identify any refunds created by the managers or quality reviewer.)

When we brought the conflicts with the separation of duties standard to the Section Chief’s attention, the review and approval duties were transferred to the Photocopy Unit manager. In addition, the Lead employee’s database permissions should limit her to adding, changing, and deleting records. The managers’ privileges should limit them to reading and approving existing records. The reviewer’s permissions should limit him to reading the records. Only the system administrator should have permission to restructure the database files. INFORMIX application software guidelines indicate that permissions can be restricted on fields within the files, which could allow more precise access privileges, such as restricting the permission to approve refunds.

Management’s Response: Management agreed with this finding. Conflicts with the separation of duties standard were corrected upon notification. Corrections will be made to ensure that only the system administrator will have permission to restructure the database files.

Photocopy personnel use the PRS to create and control manual refund transactions. However, the PRS database is not reliable and does not always provide an accurate audit trail for refunds issued. We found that managerial controls would not always prevent duplicate and triplicate refunds or ensure that all refunds would be issued. Additionally, closed records were not always archived to a table of closed refund records, and some Forms 4506 supporting refund transactions could not be located.

Specifically, we identified the following issues.

• Authorization controls did not prevent duplicate or triplicate refunds to 28 requesters, totaling over $1,900 for the period January through June 1998. We also identified eight refunds totaling about $500 that had not been issued. The PRS is not programmed to generate duplicate or unissued refund lists, and management can not query the system to identify these conditions. In addition, the PRS and the Integrated Data Retrieval System (IDRS) overage inventory controls would not identify the discrepancies. To prevent duplicate and unissued refunds, the manager would have to compare the archived to the current database records and review all closed Forms 4506.
• We compared the database records closed in the period January 1 to June 30, 1998, to the Final Photocopy Refund Lists certified in the same period. However, the weekly number of refunds and total dollar amounts did not match in any of the 25 weeks tested. A detailed comparison for 7 of the 25 weeks included 267 incidents of:
• Duplicate or triplicate database records (e.g., multiple records with the same taxpayer letter date and tax periods requested, but only one record resulted in a refund).
• Database records that did not match a refund listed on any of the seven tested Refund Lists.
• Refunds listed in one period that matched a database record closed in another period (most of these records were closed one day later than the normal weekly cut-off).

Photocopy Unit personnel created duplicate records because they were instructed that the system would not permit them to correct an error on an existing record after it was closed.

• Photocopy operating practices did not ensure that over 600 closed records were archived to the "Closed" table. The closed dates for these records ranged as far back as 1990 and included 60 additional potentially unissued refunds (see above). The Photocopy Unit manager manually archived records after they were approved. Also, the Photocopy Unit manager selected closed Forms 4506 for review from the daily Refund List, which would not include in the review refunds that were input or closed incorrectly and records that did not result in a refund. To ensure all refunds are issued, the manager would need to review all closed Forms 4506 and compare them to the database.

Management’s Response: Management agreed with this finding. The PRS database is a local program that will be replaced by a national standardized program by January 2000. Interim procedures are being implemented that will enhance the security of the program.

Photocopy Unit personnel file closed requests by month closed and by Taxpayer Identification Number (TIN) within the month. These records are the source documents for the manual refunds and must be properly stored to maintain the accountability for the refunds. Proper storage also facilitates responding to taxpayer inquiries regarding their return photocopies or refunds.

Some of the documents required to authenticate refunds could not be located. Auditors and the Photocopy Unit manager could not locate 15 of 154 Forms 4506 needed for our tests. These requests were closed between April and September 1998 and should have been filed by the time we attempted to locate them. Photocopy Unit personnel also needed eight of the requests to resolve cancelled refund check cases. The ability to locate Forms 4506 might also be critical to resolving inadvertent or intentional disclosure of tax information.

Management’s Response: Management agreed with this finding. The closed request file has been reviewed for misfiled documents. Managerial reviews are being performed on an on-going basis to ensure accurate filing of documents.

Photocopy Unit and Accounting Branch review and certification procedures were inadequate.

• The Photocopy Unit Lead clerk and manager shared the responsibility for reviewing all refunds for accuracy prior to the refunds being sent to the Section Chief for authorization. The Section Chief reassigned review responsibility to the Photocopy Unit manager. While this should provide a sufficient independent review to assure refunds are accurate and properly supported, the managers’ database permissions had not been limited to only reading and approving records to ensure independent reviews.
• The Correspondence Section Chief, or other designated managers, signed the weekly Final Photocopy Refund List as the manual refund authorizing official without reviewing the source documents.
• The Photocopy Unit does not forward photocopy requests and supporting documentation to the Accounting Branch Manual Refund function. Also, Accounting Branch Certifying Officers have not inspected the Photocopy Unit work process or reviewed sample refund source documents to provide assurance that refunds are complete and accurate and that procedures are followed. Accounting managers advised us that they rely on the Photocopy Unit authorization signature on the Photocopy Refund List as their assurance that the refunds are accurate.

Management’s Response: Management agreed with this finding. Review accountability has been reassigned to the Photocopy Unit manager to ensure refunds are accurate and properly supported. Database access for management has been limited. Program reviews of both Photocopy and Accounting procedures will be conducted by Management Support Analysts to ensure processing procedures are adhered to.

Photocopy Unit management did not ensure that the quality review of completed work was effective. All completed work was not made available for Quality Review samples. Both Quality Review and Photocopy Unit managers established a procedure for Photocopy Unit personnel to deliver completed work to Quality Review. However, Photocopy Unit managers indicated that some employees did not always follow the procedure and their work was not quality reviewed. Photocopy Unit management should control completed work so they can ensure it is available for Quality Review.

Reviewers did not ensure that all appropriate actions were taken to locate requested tax returns. Discussions with the assigned reviewer and Quality Review manager indicated that the reviewer accepted at face value follow-up actions noted on the Form 4506. An error was not charged when the history and other supporting documentation did not indicate that appropriate follow-up action was taken. None of the requests in our sample were reviewed by Quality Review.

Management’s Response: Management agreed with this finding. Procedures have been established to ensure all work is properly available for quality review. Program reviews will be conducted by management to ensure quality review of completed work was effective.

Memphis Service Center Did Not Perform Adequate Preprocessing of Forms 4506

Receipt and Control Deposit function employees review Forms 4506 for the correct payment amount before the related photocopy user fees are deposited. When requests are rejected, the incomplete forms and remittances are mailed back to the taxpayers. We observed that the correspondence used to return these requests did not request the correction of missing information such as signatures, third party authorizations, and tax periods.

In addition, employees did not always identify and reject unprocessable Forms 4506. We identified four incomplete requests in our sample of 50 refunded Forms 4506 that Deposit function personnel should have rejected, but did not. Subsequently, the Photocopy Unit identified the incomplete requests and refunded the photocopy user fees to these taxpayers with an explanation of the deficiencies. Photocopy Unit management did not provide Receipt and Control with feedback on these instances to prevent future occurrences. In addition, the Photocopy Unit refunded the photocopy user fees in 16 to 75 days, which further delayed the taxpayers’ correction and resubmission of the requests.

Management’s Response: Management agreed with this finding and has initiated a process to provide feedback to Receipt and Control. Additional training on processing Forms 4506 will be provided to employees in the Receipt and Control function.

Photocopy Unit personnel disclosed four taxpayers' tax and tax return information to unauthorized third party requesters. Four requests were submitted by third parties who were not authorized to receive the requested taxpayer information. Receipt and Control and Photocopy Unit personnel did not identify the unauthorized requests, and consequently disclosed tax information to unauthorized third parties, including copies of 7 returns and information that 11 returns had not been filed or were filed but unavailable.

The MSC Disclosure Officer advised us that she had recently identified similar instances, one resulting in a Congressional inquiry. Photocopy Unit management promptly responded to our results, and the Disclosure Officer provided additional training to Photocopy Unit employees.

Management’s Response: Management agreed with this finding. Additional disclosure training has been provided to all employees. The Disclosure Officer and management are performing periodic reviews and providing feedback on improper disclosure.

Memphis Service Center Did Not Always Take Adequate Actions to Secure Requested Tax Returns

Photocopy Unit personnel did not always take sufficient and appropriate action to secure tax returns. We reviewed 50 randomly selected Form 4506 requests that were refunded between July and September 1998. Of the 194 returns that the taxpayers requested on these 50 Forms 4506:

• 67 were located and copies sent to the taxpayer or requester (including two returns to an unauthorized requester described above).
• 127 had fees refunded because the returns were not filed, the returns were not located or were destroyed, or the requests were incomplete (including the unauthorized disclosures previously described).

Of the 127 mentioned above, 26 returns had been filed by taxpayers but Photocopy Unit personnel had not located the returns. However, the Photocopy Unit personnel should have located 13 of the 26 returns because:

• Photocopy Unit personnel did not always document follow-up actions when their initial requests did not produce the returns and the information received or lack of response to the requests indicated additional action would be appropriate.

Appropriate documentation would include any chargeouts showing the returns were not available (e.g., not in files or charged out to another function or location) and notes in the history of additional actions taken (e.g., follow-up requests or contacts with the person or function the return is charged to). Also, sufficient documentation is needed to assure reviewers that all appropriate actions were taken to obtain the returns.

• Employees did not identify two cross-reference Social Security Numbers (to locate three returns), two correct Document Locator Numbers (DLN), and one late-filed return that posted to the taxpayer’s account immediately prior to the request. Although the Photocopy Unit IRM does not specify all actions to take, the goal is to provide the requester with a quality response.

Management’s Response: Management agreed with this finding. Employees have received additional training on the use of research command codes and DLN identification. Proper case documentation is continually emphasized. Managerial reviews are also being performed to ensure the accuracy of research and documentation.

Memphis Service Center Did Not Have Adequate Inventory Controls Over Photocopy User Fee Cases

Photocopy requests that resulted in refunds were frequently not controlled or processed timely. In addition, taxpayers were not always notified of delays in receiving the returns they requested. MSC was not in compliance with Action 61 goals regarding these cases. Action 61 goals involve timely providing complete responses to inquiries and notifying taxpayers of any delays.

We sampled 50 refunded photocopy requests, and determined that the Photocopy Unit had inventory control problems. We only reviewed refund cases, but the same time frames to control cases and to send interim letters apply to both refund and non-refund cases.

Photocopy Unit personnel did not always timely control photocopy requests on IDRS. Our test showed that cases not controlled timely are not worked timely. Of the 50 sample cases, 7 were not controlled and 13 were not controlled within 14 days after the IRS received date. Of the seven not controlled, all were unprocessable or the requested returns had not been filed.

As a rule, Photocopy Unit personnel control the requests and order the returns simultaneously. In 12 of the 13 cases not controlled within 14 days, the returns were not requested within 14 days of the IRS received date. There is no formal timeliness standard for requesting the returns, but the taxpayers’ requests cannot be serviced timely without prompt action.

Contributing to delays is the time between IRS receipt and Photocopy Unit receipt of the requests. Forty of the 50 sample requests showed from 5 to 15 days between the IRS received date and the Photocopy Unit received date stamped on the requests.

In cases where the response to the taxpayer was delayed, the Photocopy Unit usually did not issue subsequent interim letters to inform taxpayers when their requests should be complete. Our review of the 50 sample requests showed that while first interim letters were generated 30 days after the IRS received date, subsequent interim letters were not mailed to 14 of 15 taxpayers when their requests were not closed within 65 days. A subsequent interim letter is required if the response is not provided by the date mentioned in the previous interim letter.

Of the 50 requests in our sample:

• Ten were closed within the 30-day quality response goal and the remaining 40 resulted in initial interim letters explaining that the response would be forthcoming within 30 days.
• Fourteen of 15 requests did not have required subsequent interim letters sent to taxpayers to explain the additional delays. These requests were closed 65 or more days after IRS receipt.

Management’s Response: Management agreed with these findings. Actions have been initiated to strive for adherence to all Action 61 goals. Procedures have been established to control requests when received in the unit. Management is providing ongoing feedback on untimely receipt of requests from other areas of the MSC. Management reviews are also being performed to improve taxpayer service.

Memphis Service Center Did Not Have Adequate Controls Over Cancelled Photocopy User Fee Refund Checks

Accounting Branch did not properly record cancelled photocopy refund checks in the General Ledger. Current MSC Accounting Branch procedures and the Revenue Accounting Control System (RACS) journal entries understate the Photocopy User Fee General Ledger Account balance. Between January and September 1998, 114 photocopy refunds for $5,470 were cancelled. No adjustments are made to correct the understatement. Furthermore, reissued refund checks would duplicate the amount charged against the account balance and increase the difference.

Accounting Branch did not revise its procedures when RACS was revised in 1995. Cancelled photocopy refunds are readily identified on the Schedule of Cancelled or Undelivered Checks (SF 1098). The RACS function should account for these amounts with journal entry window 536 and send a copy of the cancelled check list to the Photocopy Unit for resolution. Any remaining non-photocopy cancelled check amounts listed on the SF 1098 can be processed under current procedures.

In addition, Photocopy Unit personnel did not timely resolve cancelled refund checks. As of January 1999, Photocopy Unit personnel had not resolved any of 25 selected cancelled checks. The sample was selected from 51 checks cancelled between July and September 1998. No refunds had been reissued, although the review showed that nine requesters’ names, addresses, or Social Security Numbers could be corrected based on information on the Form 4506 requests. Although the IRM does not specify a timeframe for the Photocopy Unit to resolve SF1098s, prompt action is needed because space to retain closed Forms 4506 is limited.

Management’s Response: Management agreed with this finding. Cancelled checks are being accounted for with journal entry window 536. Copies of the cancelled check list are being provided directly to the Photocopy Unit.

Conclusion

Controls over photocopy user fee refunds could be improved. Our review showed that MSC personnel did not always:

• Locate available tax returns or send taxpayers timely responses.
• Properly record and account for photocopy user fee refunds.

In addition, although we did not find any indications of employee fraud, controls over photocopy user fee refunds were not effective to prevent opportunities for improper activity.

Detailed Objectives, Scope, and Methodology

Our review was conducted because of concerns that photocopy user fee payments could result in fraudulent refunds. Our audit objectives were to determine if manual refunds of photocopy user fees were properly safeguarded and recorded on the Revenue Accounting Control System (RACS), to evaluate certain inventory controls, and determine if adequate actions were taken to provide tax return photocopies to the requesters. We conducted the review during the period September 1998 to February 1999.

We held discussions with IRS personnel to evaluate controls, reviewed accounting records, reviewed randomly selected refund records, and reviewed cancelled photocopy user fee refund check cases.

To meet our audit objectives, we:

1. Evaluated controls over the input, approval, and certification process for photocopy fee refunds.
2. Reviewed selected Accounting Branch and Photocopy Unit records to identify unissued refunds and potential duplicate refunds.
3. Reviewed 50 randomly selected refund records to determine whether employees took appropriate actions to secure tax returns. Using this sample, we also evaluated Photocopy Unit inventory controls.
4. Traced cancelled refund transactions through Accounting Branch records.
5. Reviewed 25 cancelled photocopy user fee refund check cases to evaluate controls over and resolution of the cancelled checks.

Major Contributors to This Report

Walter Arrison, Assistant Inspector General for Audit (Wage and Investment Income Programs)

Susan Boehmer, Director

Steve Mullins, Director

Gerald T. Hawkins, Acting Audit Manager

Gail Yorgason, Audit Manager

Frank R. Greene, Senior Auditor

Carola Gaylord, Senior Auditor

Julia M. Collins, Auditor

Steven W. Gibson, Auditor

Cindy J. Harris, Auditor

Kim M. McManis, Auditor

Report Distribution List

Executive Officer for Service Center Operations OP:SC

Assistant Commissioner (Customer Service) OP:C

Assistant Commissioner (Forms and Submission Processing) OP:FS

Director, Memphis Customer Service Center

Director, Memphis Submission Processing Center

National Director for Legislative Affairs CL:LA

Office of Chief Counsel CC

Chief, Office of Management Controls M:CFO:A:M

Audit Liaison, Assistant Commissioner (Customer Service)

Audit Liaison, Assistant Commissioner (Forms and Submission Processing)

Management’s Response