	IRS Improved its Telephone Service for the 2016 Filing Season but Still Needs to Develop a Comprehensive Customer Service Strategy

In addition to processing approximately 150 million individual tax returns  and issuing more than 100 million refunds during the filing season, IRS  provides a range of taxpayer services, including through telephones,  written correspondence, and on its website. As a result, the telephone level of service for the entire  2016 fiscal year is expected to be at 47 percent. As we reported in  March 2016, IRS’s telephone level of service for the fiscal year has yet to  reach the levels it had achieved in earlier years (see figure 1). Implementing Our Prior Recommendations Could Help IRS Improve Customer Service

We have made recommendations to IRS and the Department of the  Treasury (Treasury), as well as a matter for congressional consideration,  to assist IRS in improving its customer service. Therefore, in December 2015, we  suggested that Congress consider requiring that Treasury work with IRS  to develop a comprehensive customer service strategy. Billions of Dollars Have Been Lost to IDT Refund Fraud, and IRS Faces Challenges in Combating This Evolving Threat

During the filing season many taxpayers learn that their private  information has been stolen and they have been victims of IDT refund  fraud. For these taxpayers, IRS has taken action to improve customer  service related to IDT refund fraud. IRS  develops estimates of the extent of IDT refund fraud to help direct its  efforts to identify and prevent the crime. However,  IRS also estimated, where data were available, that it paid $3.1 billion in  fraudulent IDT refunds. IRS recognized the challenge  of IDT refund fraud in its fiscal year 2014-2017 strategic plan and  increased resources dedicated to combating IDT and other types of  refund fraud. In January 2015, we reported that  IRS’s authentication tools have limitations and recommended that IRS  assess the costs, benefits and risks of its authentication tools. W-2 Pre-refund Matching. Increasing electronically-filed (e-file) W-2s. Agency officials and  third-party stakeholders told us that these changes include lowering  the employee threshold requirement for employers to e-file W-2s. Therefore, we have suggested that  Congress should consider providing the Secretary of the Treasury  with the regulatory authority to lower the threshold for electronic filing  of W-2s from 250 returns annually to between 5 to 10 returns, as  appropriate. In response to our recommendation, IRS provided us with a report in  September 2015 discussing (1) adjustments to IRS systems and work  processes needed to use accelerated W-2 information, (2) the  potential impacts on internal and external stakeholders, and (3) other  changes needed to match W-2 data to tax returns prior to issuing  refunds, such as delaying refunds until W-2 data are available. As we reported in March 2016, IRS has implemented numerous  controls over key financial and tax processing systems; however, it had  not always effectively implemented access and other controls, including  elements of its information security program. In our most recent review in March 2016, we found that IRS had  improved access controls, but some weaknesses remain. However, key systems we  reviewed had not been configured to encrypt sensitive user  authentication data. Nevertheless, the control weaknesses we found can be attributed in part  to IRS’s inconsistent implementation of elements of its agency-wide  information security program. We concluded in our November 2015 report that the collective effect of  the deficiencies in information security from prior years that continued to  exist in fiscal year 2015, along with the new deficiencies we identified,  were serious enough to merit the attention of those charged with  governance of IRS and therefore represented a significant deficiency in  IRS’s internal control over financial reporting systems as of September  30, 2015. Implementing GAO Recommendations Can Help IRS Better Protect Sensitive Taxpayer and Financial Data

To assist IRS in fully implementing its agency-wide information security  program, we made two new recommendations to more effectively  implement security-related policies and plans. IRS also needs to strengthen its defenses for addressing IDT refund fraud  that is informed by assessing the cost, benefits, and risks of IRS’s various  authentication options.
Why GAO Did This Study

IRS provides service to tens of millions of taxpayers and processes most tax returns during the filing season. It is also a time when legitimate taxpayers may learn that they are a victim of IDT refund fraud, which occurs when a thief files a fraudulent return using a legitimate taxpayer's identity and claims a refund. In 2015, GAO added IDT refund fraud to its high-risk area on the enforcement of tax laws and expanded its government-wide high-risk area on federal information security to include the protection of personally identifiable information. With IRS's reliance on computerized systems, recent data breaches at IRS highlight the vulnerability of sensitive taxpayer information.
This statement discusses IRS's efforts to address (1) customer service declines, (2) IDT refund fraud challenges, and (3) information security weaknesses. This statement is based on GAO reports issued between 2012 and 2016 and includes updates of selected data.

What GAO Found

The Internal Revenue Service (IRS) improved phone service to taxpayers during the 2016 filing season compared to last year. According to IRS, this is due in part to the additional $290 million in funding Congress provided to improve customer service, identity theft (IDT) refund fraud, and cybersecurity efforts. However, IRS expects its performance for the entire fiscal year will not reach the levels of earlier years. In 2012 and 2014, GAO made recommendations for IRS to improve customer service, which it has yet to implement. Consequently, in December 2015, GAO suggested that Congress require the Department of the Treasury (Treasury) to work with IRS to develop a comprehensive customer service strategy that incorporates elements of these prior recommendations.
IDT refund fraud poses a significant challenge. Although the full extent of this fraud is unknown, IRS estimates it paid $3.1 billion in IDT fraudulent refunds in filing season 2014, while preventing the processing of $22.5 billion in fraudulent refunds (see figure).
IRS has taken steps to combat IDT refund fraud, such as increasing resources dedicated to combating the problem. However, as GAO reported in August 2014 and January 2015, additional actions can further assist the agency, including assessing the costs, benefits, and risks of improving methods for authenticating taxpayers. In addition, the Consolidated Appropriations Act, 2016 included a provision to accelerate filings of W-2 information from employers to the IRS that would help IRS with pre-refund matching. GAO suggested that Congress provide Treasury with authority to lower the threshold for e-filing W-2s, which would further enhance pre-refund matching.
In March 2016, GAO reported that IRS had instituted numerous controls over key financial and tax processing systems; however, it had not always effectively implemented other controls intended to properly restrict access to systems and information, among other security measures. While IRS had improved some of its access controls, weaknesses remained in controls over key systems for identifying and authenticating users, authorizing users' level of rights and privileges, and encrypting sensitive data. These weaknesses were due in part to IRS's inconsistent implementation of its agency-wide security program, including not fully implementing 49 prior GAO recommendations. GAO concluded that these weaknesses collectively constituted a significant deficiency for the purposes of financial reporting for fiscal year 2015. As a result, taxpayer and financial data continue to be exposed to increased risk.

What GAO Recommends

GAO previously suggested that Congress consider requiring that Treasury work with IRS to develop a customer service strategy, and providing Treasury with the authority to lower the annual threshold for e-filing W-2s. GAO made prior recommendations to IRS to combat IDT refund fraud, such as assessing the costs, benefits, and risks of taxpayer authentication options, and 45 new recommendations to further improve IRS's information security controls and the implementation of its agency-wide information security program.