Weaknesses in the controls over asset management at the Internal Revenue Service leave the IRS’s information technology assets vulnerable to loss, according to a new government report.
The report, released Tuesday by the Treasury Inspector General for Tax Administration, noted that the IRS Information Technology organization controls more than 306,000 information technology assets worth almost $720 million using the Knowledge, Incident/ Problem, Service Asset Management (KISAM) system.
TIGTA found that IT asset data successfully migrated from the legacy inventory system to the KISAMAsset Manager. However, the audit log that was used to capture the events was not being reviewed to ensure that only appropriate accesses were made. In addition, information technology asset data within the KISAMAsset Manager are inaccurate and incomplete because the IRS is not following its procedures to ensure that all assets are accurately recorded and timely updated in the KISAMAsset Manager.
TIGTA also found that ineffective inventory controls created an environment where information technology assets are vulnerable to loss. TIGTA selected 146 information technology assets to physically verify and could not locate and verify or find proper supporting documentation for 34 information technology assets worth more than $948,000.In addition, IRS offices did not properly complete the annual inventory reconciliation process.
“TIGTA’s audit determined that weaknesses in controls over asset management create an environment in which information technology assets are vulnerable to loss,” said TIGTA Inspector General J. Russell George in a statement. “The risk of loss, theft, or the inadvertent release of sensitive information can decrease the public’s confidence in the IRS’s ability to monitor and use its resources effectively.”
The overall objectives of TIGTA’s report were to determine whether system user permissions were appropriate to ensure the safeguarding of the information technology asset inventory and to review the effectiveness of the system in maintaining an accurate and complete information technology asset inventory.
To improve the controls over information technology assets, TIGTA recommended that the IRS’s chief technology officer ensure that the inventory records are updated to correct the deficiencies identified in TIGTA’s review; the reconciliation process is effectively completed and offices provide supporting documentation for quality review; and dollar threshold criteria are included in the Asset Management Inventory Certification Plan for certifying information technology assets with a high-dollar value that affect financial statement reporting. TIGTA also made several recommendations that will help the IRS Information Technology organization ensure that the data captured in its inventory management system are complete and accurate and that its assets are adequately safeguarded against theft or loss.
In response to the report, IRS management agreed with all eight recommendations. IRS management agreed to deliver KISAM Asset Manager Tool enhancements for performing asset verification and correct data deficiencies identified by TIGTA; develop a missing asset aging report to facilitate researching and resolving assets in a missing status; and update the Fiscal Year 2014 Inventory Certification Plan to include the verification of the Serial Number field and assets with an acquisition value of $50,000 or greater.
However, the IRS may face challenges in terms of its budget. “We are committed to implementing these improvements; however we want to note that implementation of some actions are dependent on budget availability,” wrote IRS chief technology officer Terence V. Milholland in response to the report. “Also, while the IRS is in agreement with the eight recommendations provided by TIGTA, we take exception to the outcome measures outlined in the draft report. KISAM-AM is the sole authoritative source and official inventory repository for all information technology assets; it is not the authoritative source for financial data. As such, KISAM does not calculate the current market value of assets.
Register or login for access to this item and much more
All Accounting Today content is archived after seven days.
Community members receive:
- All recent and archived articles
- Conference offers and updates
- A full menu of enewsletter options
- Web seminars, white papers, ebooks
Already have an account? Log In
Don't have an account? Register for Free Unlimited Access