IRS Has Material Weakness in Internal Controls Over Unpaid Tax Assessments

The Internal Revenue Service (IRS) is currently planning activities to address a recurring financial material weakness in its internal control over unpaid tax assessments. However, planning for the Customer Account Data Engine 2 (CADE 2) Transition State 2 (TS2) has not included specific actions and activities necessary to guide new system development efforts and to successfully address the IRS financial material weakness as needed.

That is the conclusion of a new report publicly released today by the Treasury Inspector General for Tax Administration.

Since 1993, the U.S. Government Accountability Office (GAO) has reported a recurring financial material weakness in the IRS internal control over unpaid tax assessments. The long-standing material weakness is due, in large part, to system deficiencies that render IRS’s systems unable to readily distinguish unpaid assessments among taxes receivable, compliance assessments, and write-offs in order to properly classify these components for financial reporting purposes. The IRS is required to complete a remediation plan that includes remedies, estimated and actual resources, and target dates to bring its financial systems into compliance.

The CADE 2 Program is expected to replace the Individual Master File (IMF) account settlement system with a relational database and become a key component of the IRS’s enterprisewide, data-centric information technology strategy. With TS 2, the IRS is planning to reengineer the IMF by: 1) Applying modern programming languages, 2) Establishing CADE 2 as an authoritative data source, and 3) Implementing functionality to address the IRS financial material weakness over unpaid tax assessments for individual taxpayer accounts. TIGTA evaluated the IRS’s approach and progress toward developing system requirements that will address the IRS financial material weakness with ongoing planning for TS2.

With respect to the planning activities to address the IRS financial material weakness for individual taxpayer accounts, TIGTA is concerned that: (1) the remediation plan does not include the CADE 2 TS2 actions for addressing the financial material weakness; (2) the CADE 2 TS2 cost estimates for addressing the weakness are not in place; and (3) the current system classification for the CADE 2 does not provide sufficient guidance for addressing the IRS financial material weakness. A security strategy also is needed to support TS2 as an authoritative source of data.

“It is imperative that the IRS ensure that all its information technology projects, including those associated with CADE 2, are financially sound and secure, as well as capable of performing the tasks they are designed to perform,” said J. Russell George, Treasury Inspector General for Tax Administration.

TIGTA recommended: (1) planned actions and estimated costs for addressing the weakness be included in the IRS Remediation Plan; (2) accurate cost estimates align system planning with the business strategy for addressing the IRS financial material weakness; (3) complete cost information for the IRS Remediation Plan; (4) a security strategy to support goals for protecting sensitive systems and data; and (5) classifying CADE 2 within guidelines to better ensure that adequate internal controls for financial management systems.

The IRS plans to develop CADE 2 TS2 Basis of Estimate costs by September 2015. The IRS disagreed, however, with the remaining recommendations. TIGTA believes that the IRS should carefully consider the basis and adequacy of cost estimates for CADE 2 functionality aimed specifically at resolving its long-standing financial material weakness. TIGTA stresses the necessity of a security strategy to guide TS2 within goals for protecting sensitive systems and data. Further, TIGTA emphasizes the importance of reclassifying CADE 2 to ensure that internal controls for financial management systems are considered and designed with TS2.