TIGTA: IRS’s CADE Needs Work

The Treasury Inspector General for Tax Administration released two reports related to the Internal Revenue Service’s Customer Account Data Engine 2 Program, suggesting that while the system has begun processing tax returns, there are still significant areas where improvement is necessary.

The CADE 2 Program aims to create a high-powered transactional database that will let the IRS and its staff access and process taxpayer data much more efficiently. It is currently in Transition State 1, the initial stage of implementing its centralized database of individual taxpayer accounts.

“The goal of the CADE 2 system, to provide state-of-the-art individual taxpayer account processing and enhanced IRS tax administration, is laudable,” said Inspector General J. Russell George. “However, in pursuit of that goal, the IRS must not lose sight of the importance of having complete, accurate and secured data, which is just as important as improved processing capabilities.”

TIGTA reviewed whether the requirements and testing practices for Transition State 1 were performed in accordance with applicable policies and procedures necessary for developing systems. It also examined whether the IRS was meeting its Transition State 1 goals, specifically in its development and implementation of the CADE 2 database.

In the first report, “Customer Account Data Engine 2 (CADE 2): System Requirements and Testing Processes Need Improvements,” TIGTA found that while the IRS conducted extensive system development testing, planned risks reduction, and implemented new controls over the program, enhancements to system development controls are needed to better verify that all of the IRS’s many requirements are adequately addressed by the new system. TIGTA made eight recommendations to the IRS to improve its system requirements management and testing processes. The IRS agreed with five of TIGTA’s recommendations and disagreed or partially disagreed with three others.

In the second report, “The Customer Account Data Engine 2 Database Was Initialized; However, Database and Security Risks Remain, and Initial Timeframes to Provide Data to Three Downstream Systems May Not Be Met,” TIGTA found that testing did not provide assurance that data in the CADE 2 are consistently accurate and complete. Also, security weaknesses and poor coding practices in the database could result in the loss of taxpayer data.

TIGTA made seven recommendations to the IRS, including that the CADE 2 Program not exit Transition Stage 1 until the database can provide accurate and complete data to three downstream systems. The IRS agreed with this and two other recommendations and partially agreed with one of the recommendations; corrective actions are planned. The IRS disagreed with three recommendations, and TIGTA provided comments in the report.