The Internal Revenue Service needs to remedy serious weaknesses over taxpayer and Bank Secrecy Act data that leave its systems vulnerable, according to a report released by the Government Accountability Office.

In a report released last Friday, the GAO said that the IRS has made progress in correcting or mitigating previously reported information security weaknesses and in implementing controls over key financial and tax processing systems located at one of its critical data processing facilities, fixing 32 of the 53 weaknesses that the GAO reported as unresolved at the time of its prior review in 2002.

However, the GAO noted that, in addition to the remaining 21 weaknesses that haven't been corrected, 39 newly identified information security control weaknesses impair the IRS's ability to ensure the confidentiality, integrity and availability of its sensitive financial and taxpayer data and Bank Secrecy Act data.

For example, the GAO said that the agency hasn't implemented effective electronic access controls over its mainframe computing environment to logically separate its taxpayer data from Bank Secrecy Act data -- two types of data with different security requirements. In addition, the IRS hasn't effectively implemented certain other information security controls relating to physical security, segregation of duties, and service continuity at the facility.

"Collectively, these weaknesses increase the risk that sensitive taxpayer and Bank Secrecy Act data will be inadequately protected from unauthorized disclosure, modification, use or destruction," the GAO said. "Moreover, weaknesses in service continuity and business resumption plans heighten the risk that assets will be inadequately protected and controlled to ensure the continuity of operations when unexpected interruptions occur."

"Until the IRS fully implements a comprehensive agency-wide information security program, its facilities and computing resources and the information that is processed, stored and transmitted on its systems will remain vulnerable," the GAO said.

Register or login for access to this item and much more

All Accounting Today content is archived after seven days.

Community members receive:
  • All recent and archived articles
  • Conference offers and updates
  • A full menu of enewsletter options
  • Web seminars, white papers, ebooks

Don't have an account? Register for Free Unlimited Access