In carrying out its mission, IRS relies extensively on computerized  information systems, which it must effectively secure to protect sensitive  financial and taxpayer data for the collection of taxes, processing of tax  returns, and enforcement of federal tax laws. Accordingly, it is critical for  IRS to effectively implement information security controls and an agency- wide information security program in accordance with federal law and  guidance. Although IRS Has Made Improvements, Information Security Weaknesses Continue to Place Taxpayer and Financial Data at Risk

As we reported in March 2016, IRS has implemented numerous controls  over key financial and tax processing systems; however, it had not always  effectively implemented access and other controls, including elements  of its information security program. Nevertheless, the control weaknesses can be attributed in part to IRS’s  inconsistent implementation of elements of its agency-wide information  security program. The collective effect of the deficiencies in information security from prior  years that continued to exist in fiscal year 2015, along with the new  deficiencies we identified, are serious enough to merit the attention of  those charged with governance of IRS and therefore represented a  significant deficiency in IRS’s internal control over financial reporting  systems as of September 30, 2015. Implementing GAO Recommendations Can Help IRS Better Protect Sensitive Taxpayer and Financial Data

To assist IRS in fully implementing its agency-wide information security  program, we made two new recommendations to more effectively  implement security-related policies and plans. Implementing these recommendations—in addition to the 49 outstanding  recommendations from previous audits—will help IRS improve its controls  for identifying and authenticating users, limiting users’ access to the  minimum necessary to perform their job-related functions, protecting  sensitive data when they are stored or in transit, auditing and monitoring  system activities, and physically securing its IT facilities and resources. While its estimates have inherent uncertainty, IRS estimated that it  prevented or recovered $22.5 billion in fraudulent IDT refunds in filing  season 2014 (see figure 1). However, IRS also estimated, where data  were available, that it paid $3.1 billion in fraudulent IDT refunds. IRS has taken steps to address IDT refund fraud; however, it remains a  persistent and continually changing threat. As described above, IRS received an additional  $290 million for fiscal year 2016 to improve customer service, IDT  identification and prevention, and cybersecurity efforts and the agency  plans to use $16.1 million of this funding to help prevent IDT refund fraud,  among other things. IRS also works with third parties, such as tax preparation industry  participants, states, and financial institutions to try to detect and prevent  IDT refund fraud. In January 2015, we reported that IRS’s  authentication tools have limitations and recommended that IRS  assess the costs, benefits and risks of its authentication tools. Form W-2, Wage and Tax Statement (W-2) Pre-refund Matching. In August 2014 we reported that the wage information that employers  report on Form W-2 is not available to IRS until after it issues most  refunds, and that if IRS had access to W-2 data earlier, it could match  such information to taxpayers’ returns and identify discrepancies  before issuing billions of dollars of fraudulent IDT refunds. In  December 2015, the Consolidated Appropriations Act of 2016  amended the tax code to accelerate W-2 filing deadlines to January  31. Through April 1, 2016, IRS had processed about 95 million returns and  issued 76 million refunds totaling about $215 billion. Weaknesses in information security can also increase the risk posed by  identity theft refund fraud. IRS needs to establish an approach for  addressing identity theft refund fraud that is informed by assessing the  cost, benefits, and risks of IRS’s various authentication options and  improving the reliability of fraud estimates. While this year’s tax filing season has generally gone smoothly and IRS  has improved customer service, it still needs to develop a comprehensive  approach to customer service that will meet the needs of taxpayers while  ensuring that their sensitive information is adequately protected.
Why GAO Did This Study

In collecting taxes, processing returns, and providing taxpayer service, IRS relies extensively on computerized systems. Thus it is critical that sensitive taxpayer and other data are protected. Recent data breaches at IRS highlight the vulnerability of taxpayer information. In addition, identity theft refund fraud is an evolving threat to honest taxpayers and tax administration. This crime occurs when a thief files a fraudulent return using a legitimate taxpayer's identity and claims a refund. In 2015, GAO added identity theft refund fraud to its high-risk area on the enforcement of tax laws and expanded its government-wide high-risk area on federal information security to include the protection of personally identifiable information.
This statement discusses (1) IRS information security controls over financial and tax processing systems, (2) IRS actions to address identity theft refund fraud, and (3) the status of selected IRS filing season operations. This statement is based on previously published GAO work as well as an update of selected data.

What GAO Found

In March 2016, GAO reported that the Internal Revenue Service (IRS) had instituted numerous controls over key financial and tax processing systems; however, it had not always effectively implemented other controls intended to properly restrict access to systems and information, among other security measures. In particular, while IRS had improved some of its access controls, weaknesses remained in key controls for identifying and authenticating users, authorizing users' level of rights and privileges, encrypting sensitive data, auditing and monitoring network activity, and physically securing facilities housing its information technology resources. These weaknesses were due in part to IRS's inconsistent implementation of its agency-wide security program, including not fully implementing prior GAO recommendations. GAO concluded that these weaknesses collectively constituted a significant deficiency for the purposes of financial reporting for fiscal year 2015. As a result, taxpayer and financial data continue to be exposed to unnecessary risk.
Identity theft refund fraud also poses a significant challenge. IRS estimates it paid $3.1 billion in these fraudulent refunds in filing season 2014, while preventing $22.5 billion (see figure). The full extent is unknown because of the challenges inherent in detecting this form of fraud.
IRS has taken steps to combat identity theft refund fraud such as improving phone service for taxpayers to report suspected identity theft and working with industry, states, and financial institutions to detect and prevent it. However, as GAO reported in August 2014 and January 2015, additional actions can further assist the agency in addressing this crime, including pre-refund matching of taxpayer returns with information returns from employers, and assessing the costs, benefits, and risks of improving methods for authenticating taxpayers. In addition, the Consolidated Appropriations Act 2016 includes a provision that would help IRS with pre-refund matching and also includes an additional $290 million to enhance cybersecurity, combat identity theft refund fraud, and improve customer service.
According to IRS and industry partners, the 2016 filing season has generally gone smoothly, with about 95 million returns and $215 billion in refunds processed through April 1, 2016. In addition, IRS increased its level of phone service to taxpayers, although it has not developed a comprehensive strategy for customer service as GAO recommended in December 2015.

What GAO Recommends

In addition to 49 prior recommendations that had not been implemented, GAO made 45 new recommendations to IRS to further improve its information security controls and the implementation of its agency-wide information security program. GAO has also made recommendations to help IRS combat identity theft refund fraud, such as assessing costs, benefits, and risks of taxpayer authentication options.