With the government shutdown having recently tested the preparedness of the Internal Revenue Service to deal with sudden downtime, a new report finds the agency needs to make improvements to ensure that timely resumption of critical business processes occurs after an emergency.
The
TIGTA found that the IRS did not always demonstrate that its continuity plan process would ensure that critical business processes are resumed in a timely manner. For example, the IRS did not meet the fiscal year 2012 annual reporting requirement to the Treasury Department certifying its continuity capability plan.
In addition, some continuity plans were not prepared as required or were missing key information to facilitate the resumption of critical IRS operations. For example, four of the 22 business units’ system-wide continuity plans were not prepared. In addition, one local office within a business unit did not have site specific continuity processes or a plan to resume its critical functions after an emergency. Even when local site specific continuity processes and plans were prepared, some of them did not contain all of the elements consistent with both Federal and IRS guidance.
Since August 2012, the IRS has not used a central repository for immediate access by management to continuity plans in the event of an emergency, TIGTA pointed out. In addition, continuity personnel responsible for updating and maintaining the plans often changed jobs, and new personnel were not adequately trained to carry out all of their responsibilities regarding continuity planning. Finally, the IRS did not perform sufficient testing and exercises as required to validate recovery strategies and procedures or to adequately address weaknesses identified during continuity exercises to ensure the viability of the continuity plan in the event of an emergency.
TIGTA recommended that the chief of the IRS’s Agency-Wide Shared Services department implement a process to ensure that the annual certification requirement is met. The IRS should also ensure that continuity plans are immediately prepared for four business units and that the existing continuity plan template is used by all business units and functional offices, the report suggested. In addition, the IRS should identify and monitor appropriate training to be completed by field personnel responsible for continuity planning; develop a plan that establishes time frames for the implementation of a fully functioning continuity plan database; and establish a process to monitor the continuity tests and exercise program so that business unit personnel meet the annual requirements.
In response to the report, IRS management agreed with all eight recommendations and said they plan to take or have taken corrective actions, including updating policies and monitoring training requirements. “We are committed to ensuring our continuity program will enable the IRS to resume the processing of critical functions in a timely manner, in the event of an emergency,” said David A. Grant, IRS chief of Agency-Wide Shared Services.
