To the Commissioner of Internal Revenue In our audits of the fiscal years 2019 and 2018 financial statements of the Internal Revenue Service (IRS), we found IRS’s financial statements as of and for the fiscal years ended September 30, 2019, and 2018, are presented fairly, in all material respects, in accordance with U.S. generally accepted accounting principles; although internal controls could be improved, IRS maintained, in all material respects, effective internal control over financial reporting as of September 30, 2019; and no reportable noncompliance for fiscal year 2019 with provisions of applicable laws, regulations, contracts, and grant agreements we tested. The following sections discuss in more detail (1) our report on the financial statements and on internal control over financial reporting, which includes required supplementary information (RSI) and other information included with the financial statements; (2) our report on compliance with laws, regulations, contracts, and grant agreements; and (3) agency comments. In accordance with our authority conferred by the Chief Financial Officers (CFO) Act of 1990, as amended by the Government Management Reform Act of 1994, we have audited IRS’s financial statements. IRS’s financial statements comprise the balance sheets as of September 30, 2019, and 2018; the related statements of net cost, changes in net position, budgetary resources, and custodial activity for the fiscal years then ended; and the related notes to the financial statements. We also have audited IRS’s internal control over financial reporting as of September 30, 2019, based on criteria established under 31 U.S.C. § 3512(c), (d), commonly known as the Federal Managers’ Financial Integrity Act (FMFIA). We conducted our audits in accordance with U.S. generally accepted government auditing standards. We believe that the audit evidence we obtained is sufficient and appropriate to provide a basis for our audit opinions. IRS management is responsible for (1) the preparation and fair presentation of these financial statements in accordance with U.S. generally accepted accounting principles; (2) preparing, measuring, and presenting the RSI in accordance with U.S. generally accepted accounting principles; (3) preparing and presenting other information included in documents containing the audited financial statements and auditor’s report, and ensuring the consistency of that information with the audited financial statements and the RSI; (4) maintaining effective internal control over financial reporting, including the design, implementation, and maintenance of internal control relevant to the preparation and fair presentation of financial statements that are free from material misstatement, whether due to fraud or error; (5) evaluating the effectiveness of internal control over financial reporting based on the criteria established under FMFIA; and (6) its assessment about the effectiveness of internal control over financial reporting as of September 30, 2019, included in the accompanying Management’s Report on Internal Control over Financial Reporting in appendix I. Our responsibility is to express an opinion on these financial statements and an opinion on IRS’s internal control over financial reporting based on our audits. U.S. generally accepted government auditing standards require that we plan and perform the audits to obtain reasonable assurance about whether the financial statements are free from material misstatement, and whether effective internal control over financial reporting was maintained in all material respects. We are also responsible for applying certain limited procedures to RSI and other information included with the financial statements. An audit of financial statements involves performing procedures to obtain audit evidence about the amounts and disclosures in the financial statements. The procedures selected depend on the auditor’s judgment, including the auditor’s assessment of the risks of material misstatement of the financial statements, whether due to fraud or error. In making those risk assessments, the auditor considers internal control relevant to the entity’s preparation and fair presentation of the financial statements in order to design audit procedures that are appropriate in the circumstances. An audit of financial statements also involves evaluating the appropriateness of the accounting policies used and the reasonableness of significant accounting estimates made by management, as well as evaluating the overall presentation of the financial statements. An audit of internal control over financial reporting involves performing procedures to obtain evidence about whether a material weakness exists. The procedures selected depend on the auditor’s judgment, including the assessment of the risk that a material weakness exists. An audit of internal control over financial reporting also includes obtaining an understanding of internal control over financial reporting, and evaluating and testing the design and operating effectiveness of internal control over financial reporting based on the assessed risk. Our audit of internal control also considered IRS’s process for evaluating and reporting on internal control over financial reporting based on criteria established under FMFIA. Our audits also included performing such other procedures as we considered necessary in the circumstances. We did not evaluate all internal controls relevant to operating objectives as broadly established under FMFIA, such as those controls relevant to preparing performance information and ensuring efficient operations. We limited our internal control testing to testing controls over financial reporting. Our internal control testing was for the purpose of expressing an opinion on whether effective internal control over financial reporting was maintained, in all material respects. Consequently, our audit may not identify all deficiencies in internal control over financial reporting that are less severe than a material weakness. An entity’s internal control over financial reporting is a process effected by those charged with governance, management, and other personnel, the objectives of which are to provide reasonable assurance that (1) transactions are properly recorded, processed, and summarized to permit the preparation of financial statements in accordance with U.S. generally accepted accounting principles, and assets are safeguarded against loss from unauthorized acquisition, use, or disposition, and (2) transactions are executed in accordance with provisions of applicable laws, including those governing the use of budget authority, regulations, contracts, and grant agreements, noncompliance with which could have a material effect on the financial statements. Because of its inherent limitations, internal control over financial reporting may not prevent, or detect and correct, misstatements due to fraud or error. We also caution that projecting any evaluation of effectiveness to future periods is subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate. In our opinion, IRS’s financial statements present fairly, in all material respects, IRS’s financial position as of September 30, 2019, and 2018, and its net cost of operations, changes in net position, budgetary resources, and custodial activity for the fiscal years then ended in accordance with U.S. generally accepted accounting principles. In accordance with federal accounting standards, IRS’s financial statements do not include an estimate of the dollar amount of taxes that are owed to the federal government but that taxpayers have not reported or that IRS has not identified through its enforcement programs, often referred to as the tax gap, nor do they include information on tax expenditures. Further detail on the tax gap and tax expenditures, as well as the associated dollar amounts, is provided in the other information included with the financial statements. In our opinion, although internal controls could be improved, IRS maintained, in all material respects, effective internal control over financial reporting as of September 30, 2019, based on criteria established under FMFIA. Our fiscal year 2019 audit identified continuing deficiencies concerning IRS’s internal control over unpaid assessments and continuing and new deficiencies concerning IRS’s internal control over financial reporting systems. While not considered material weaknesses, these deficiencies are collectively important enough to merit attention by those charged with governance of IRS. Therefore, we considered these issues affecting IRS’s internal controls over unpaid assessments and financial reporting systems to be significant deficiencies in internal control as of September 30, 2019. These two significant deficiencies are discussed in more detail below. We considered these significant deficiencies in determining the nature, timing, and extent of our audit procedures on IRS’s fiscal year 2019 financial statements. Although the significant deficiencies in internal control did not affect our opinion on IRS’s fiscal year 2019 financial statements, misstatements may occur in unaudited financial information reported internally and externally by IRS because of these significant deficiencies. In addition, because of the significant deficiencies in internal controls over unpaid assessments and financial reporting systems that existed during fiscal year 2019, IRS’s financial management systems did not comply substantially with federal financial management systems requirements as required by the Federal Financial Management Improvement Act of 1996. We will be reporting additional details concerning any new issues relating to these significant deficiencies separately to IRS management, along with recommendations for corrective actions. We also identified other deficiencies in IRS’s internal control over financial reporting that we do not consider to be material weaknesses or significant deficiencies. Nonetheless, these deficiencies warrant IRS management’s attention. We have communicated these matters to IRS management and, where appropriate, will report on them separately along with related recommendations for corrective actions. Further, as we have reported in past audits, IRS continues to face significant ongoing financial management challenges relating to safeguarding taxpayer receipts and associated information, and preventing and detecting fraudulent refunds based on identify theft. Although these challenges do not rise to the level of significant deficiencies in internal control, we believe they are sensitive matters requiring IRS management’s attention. We have made several recommendations to IRS to enhance its internal controls to mitigate these challenges. It is important that IRS continue its efforts to minimize the risks these challenges pose to taxpayers and any associated losses to the federal government. Limitations in the financial systems IRS uses to account for federal taxes receivable and other unpaid assessment balances, as well as other control deficiencies that led to errors in taxpayer accounts, continued to exist during fiscal year 2019. As a result of these deficiencies, IRS’s systems were unable to provide the timely, reliable, and complete transaction-level financial information necessary to enable IRS to appropriately classify and report unpaid assessment balances. As in prior years, IRS used a complex and labor-intensive statistical estimation process to compensate for the effects of its system limitations and other deficiencies on a material portion of its federal taxes receivable balance to help ensure that this balance was free of material misstatement. During fiscal year 2019, IRS recorded adjustments totaling about $17 billion to correct the effects of continued errors in its underlying data that IRS identified during its manual estimation process. While using this process to determine a material portion of taxes receivable has enabled IRS to produce reliable related balances for year- end reporting, it does not provide IRS management with readily available, reliable unpaid assessment information on a daily basis throughout the year in order to effectively manage unpaid assessment balances. Further, errors in taxpayer accounts create a burden for those taxpayers whose accounts were affected. While not collectively considered a material weakness, IRS’s ongoing control deficiencies related to unpaid assessments are important enough to merit attention by those charged with governance of IRS. Therefore, these issues represent a significant deficiency in IRS’s internal control over financial reporting as of September 30, 2019. During fiscal year 2019, IRS documented the key management decisions in the design and use of the estimation process. This step should reduce the risk that IRS may perform sampling procedures inconsistent with management intent or plans. Continued management commitment and sustained efforts are necessary to build on the progress made to date and to fully address IRS’s remaining unresolved issues concerning the management and reporting of unpaid assessments. During our fiscal year 2019 audit, we determined that unresolved information system control deficiencies from prior audits, along with new control deficiencies pertaining to business process application controls and general controls in IRS’s information systems, collectively represent a significant deficiency in IRS’s internal control over financial reporting systems. Specifically, IRS did not correct control deficiencies we reported as of September 30, 2018, concerning (1) unnecessary access rights granted to accounts, (2) inconsistent monitoring of systems and accounts, (3) out-of-date and unsupported hardware and software, (4) change controls over tax and financial management processing on the mainframe, and (5) developing and implementing effective policies and procedures as part of IRS’s security management program. In addition, during this year’s audit, we found new control deficiencies in the following areas: (1) implementing automated financial controls of interfaces between key applications, (2) ensuring that authorized personnel reviewed key documents for external systems, (3) enforcing multifactor authentication, (4) enforcing adequate encryption to protect systems and data, or (5) ensuring that patches installed on systems were current to protect against known vulnerabilities. The potential effect of these continuing and new deficiencies on IRS’s financial reporting for fiscal year 2019 was mitigated primarily by IRS’s compensating management controls designed to detect potential misstatements on the financial statements. Nevertheless, these application and general control deficiencies increase the risk of unauthorized access to, modification of, or disclosure of sensitive financial and taxpayer data and disruption of critical operations, and are therefore important enough to merit the attention of those charged with governance of IRS. According to IRS management, IRS has developed a plan that focuses on strengthening its information system controls. Continued and consistent management commitment and attention will be essential to addressing existing financial reporting system deficiencies. U.S. generally accepted accounting principles issued by the Federal Accounting Standards Advisory Board (FASAB) require that the RSI be presented to supplement the financial statements. Although the RSI is not a part of the financial statements, FASAB considers this information to be an essential part of financial reporting for placing the financial statements in appropriate operational, economic, or historical context. We have applied certain limited procedures to the RSI in accordance with U.S. generally accepted government auditing standards, which consisted of inquiries of management about the methods of preparing the RSI and comparing the information for consistency with management’s responses to the auditor’s inquiries, the financial statements, and other knowledge we obtained during the audit of the financial statements, in order to report omissions or material departures from FASAB guidelines, if any, identified by these limited procedures. We did not audit and we do not express an opinion or provide any assurance on the RSI because the limited procedures we applied do not provide sufficient evidence to express an opinion or provide any assurance. IRS’s other information contains a wide range of information, some of which is not directly related to the financial statements. This information is presented for purposes of additional analysis and is not a required part of the financial statements or the RSI. We read the other information included with the financial statements in order to identify material inconsistencies, if any, with the audited financial statements. Our audit was conducted for the purpose of forming an opinion on IRS’s financial statements. We did not audit and do not express an opinion or provide any assurance on the other information. In connection with our audits of IRS’s financial statements, we tested compliance with selected provisions of applicable laws, regulations, contracts, and grant agreements consistent with our auditor’s responsibility discussed below. We caution that noncompliance may occur and not be detected by these tests. We performed our tests of compliance in accordance with U.S. generally accepted government auditing standards. IRS management is responsible for complying with laws, regulations, contracts, and grant agreements applicable to IRS. Our responsibility is to test compliance with selected provisions of laws, regulations, contracts, and grant agreements applicable to IRS that have a direct effect on the determination of material amounts and disclosures in IRS’s financial statements, and perform certain other limited procedures. Accordingly, we did not test compliance with all laws, regulations, contracts, and grant agreements applicable to IRS. Our tests for compliance with selected provisions of applicable laws, regulations, contracts, and grant agreements disclosed no instances of noncompliance for fiscal year 2019 that would be reportable under U.S. generally accepted government auditing standards. However, the objective of our tests was not to provide an opinion on compliance with laws, regulations, contracts, and grant agreements applicable to IRS. Accordingly, we do not express such an opinion. The purpose of this report is solely to describe the scope of our testing of compliance with selected provisions of applicable laws, regulations, contracts, and grant agreements and the results of that testing, and not to provide an opinion on compliance. This report is an integral part of an audit performed in accordance with U.S. generally accepted government auditing standards in considering compliance. Accordingly, this report on compliance with laws, regulations, contracts, and grant agreements is not suitable for any other purpose. In commenting on a draft of this report, IRS stated that it was pleased to receive an unmodified opinion on its financial statements. IRS also commented on its continued efforts to address its financial reporting systems control deficiencies and improve its internal controls in financial reporting of unpaid assessments. The complete text of IRS’s response is reproduced in appendix II.
In accordance with the authority conferred by the Chief Financial Officers Act of 1990, as amended, GAO annually audits IRS's financial statements to determine whether (1) the financial statements are fairly presented and (2) IRS management maintained effective internal control over financial reporting. GAO also tests IRS's compliance with selected provisions of applicable laws, regulations, contracts, and grant agreements. IRS's tax collection activities are significant to overall federal receipts, and the effectiveness of its financial management is of substantial interest to Congress and the nation's taxpayers. In GAO's opinion, the Internal Revenue Service's (IRS) fiscal years 2019 and 2018 financial statements are fairly presented in all material respects, and although controls could be improved, IRS maintained, in all material respects, effective internal control over financial reporting as of September 30, 2019. GAO's tests of IRS's compliance with selected provisions of applicable laws, regulations, contracts, and grant agreements detected no reportable instances of noncompliance in fiscal year 2019. Limitations in the financial systems IRS uses to account for federal taxes receivable and other unpaid assessment balances, as well as other control deficiencies that led to errors in taxpayer accounts, continued to exist during fiscal year 2019.These control deficiencies affect IRS's ability to produce reliable financial statements without using significant compensating procedures. In addition, unresolved information system control deficiencies from prior audits, along with application and general control deficiencies that GAO identified in IRS's information systems in fiscal year 2019, placed IRS systems and financial and taxpayer data at risk of inappropriate and undetected use, modification, or disclosure. IRS continues to take steps to improve internal controls in these areas. However, the remaining deficiencies are significant enough to merit the attention of those charged with governance of IRS and therefore represent continuing significant deficiencies in internal control over financial reporting related to (1) unpaid assessments and (2) financial reporting systems. Continued management attention is essential to fully addressing these significant deficiencies. Based on prior financial statement audits, GAO made numerous recommendations to IRS to address internal control deficiencies. GAO will continue to monitor and will report separately on IRS's progress in implementing prior recommendations that remain open. Consistent with past practice, GAO will also be separately reporting on the new internal control deficiencies identified in this year's audit and providing IRS recommendations for corrective actions to address them. In commenting on a draft of this report, IRS stated that it continues its efforts to improve its financial reporting systems controls and internal controls over unpaid assessments.