The Internal Revenue Service did not maintain effective internal control over financial reporting as of Sept. 30, 2014, because of a continuing material weakness in internal control over unpaid tax assessments, according to a new
The GAO did acknowledge in the report on the IRS’s fiscal year 2013 and 2014 financial statements that they were fairly presented in all material respects. In addition, the GAO’s tests of the IRS’s compliance with selected provisions of applicable laws, regulations, contracts and grant agreements detected no reportable instances of noncompliance in fiscal year 2014.
The material weakness in internal control over unpaid tax assessments was mainly caused by financial system limitations and errors in taxpayer accounts that rendered the IRS’s systems unable to readily distinguish between taxes receivable, compliance assessments, and write-offs in order to properly classify these components for financial reporting purposes, the GAO pointed out.
These deficiencies required the use of a compensating estimation process to determine the amount of taxes receivable, the most material asset on the IRS’s balance sheet. Through this compensating process, the IRS made almost $17 billion in adjustments to the 2014 fiscal year-end gross taxes receivable balance produced by its financial systems.
“Serious control deficiencies related to unpaid tax assessments are likely to continue to exist until IRS significantly enhances the capabilities of the systems it uses to account for unpaid tax assessments, and improves controls over the recording of information in taxpayer accounts so that reliable transaction-based balances for taxes receivable can be ultimately recorded in its general ledger system,” said the GAO report. “However, IRS’s current corrective action plan does not fully address all of the system enhancements needed to accurately classify unpaid tax assessment transactions, and IRS has yet to identify the underlying control deficiencies causing the errors in taxpayer accounts.”
During fiscal year 2014, the IRS continued to make important progress in addressing deficiencies in internal control over its financial reporting systems. However, the GAO identified new and continuing deficiencies in internal control over information security, including missing security updates, insufficient monitoring of financial reporting systems and mainframe security, and ineffective maintenance of key application security. These constituted a significant deficiency in the IRS's internal control over financial reporting systems, according to the GAO.
“Until IRS fully addresses existing control deficiencies over its financial reporting systems, there is an increased risk that its financial and taxpayer data will remain vulnerable to inappropriate and undetected use, modification, or disclosure,” warned the GAO.
In addition to its internal control deficiencies, the IRS faces significant ongoing financial management challenges associated with safeguarding the large volume of sensitive hard copy taxpayer receipts and related information, its exposure to significant invalid refunds from identity theft, and implementing the tax provisions of the Patient Protection and Affordable Care Act, according to the GAO.
“The difficulties confronting IRS in its efforts to effectively manage each of these challenges are further magnified by the need to do so in an environment of diminished budgetary resources,” the GAO added.
Based on its previous financial statement audits of the IRS, the GAO pointed out that it has already made numerous recommendations to the IRS to address the agency’s internal control deficiencies. The GAO said it would continue to monitor and report separately on the IRS’s progress in implementing prior recommendations that remain open. Consistent with past practice, the GAO will also be separately reporting on the new internal control deficiencies identified in this year's audit and providing the IRS recommendations for corrective actions to address them.
In commenting on a draft of the GAO’s report, the IRS indicated that it is dedicated to continuing to improve its financial management and internal controls, and has taken steps to implement its financial reporting responsibilities under the Patient Protection and Affordable Care Act.
“Based on our evaluation, the IRS has one material weakness in its internal control over financial reporting, specifically unpaid tax assessments,” wrote IRS commissioner John Koskinen, in response to the report. “The IRS’s financial management systems do not substantially comply with the requirements of the Federal Financial Management Improvement Act. On this basis, management provides assurance that as of September 30, 2014, the IRS’s internal control over financial reporting was effective.”
