IRS Is the Tax Collector for the United States

IRS has demanding responsibilities in collecting taxes, processing tax  returns, and enforcing federal tax laws, and relies extensively on  computerized systems to support its financial and mission-related  operations. These weaknesses continue to jeopardize the confidentiality,  integrity, and availability of the financial and sensitive taxpayer  information processed by IRS’s systems and, considered collectively, are  the basis of our determination that IRS had a material weakness in internal  control over its financial reporting related to information security in fiscal  year 2010. Organizations accomplish this objective by designing and implementing  controls that are intended to prevent, limit, and detect unauthorized  access to computing resources, programs, information, and facilities. For example, IRS granted excessive privileges to  a database account on the online system used to support and manage its  computer access request, approval, and review process. For  example, IRS did not enable security event auditing or system privilege  auditing features on databases that support its access authorization,  administrative accounting, and procurement systems. Although IRS had implemented numerous physical security controls,  certain controls were not working as intended, and the agency had not  consistently applied the policy in others. Although IRS made progress in updating certain systems, it did not always  apply critical patches to its databases that support two financial  applications. IRS Has Not Fully Implemented Key Components of Its Information Security Program

An underlying reason for the information security weaknesses in IRS’s  financial and tax processing systems is that it has not yet fully  implemented key components of its comprehensive information security  program. FISMA requires each agency to develop, document, and  implement an information security program that, among other things,  includes:    periodic assessments of the risk and magnitude of harm that could result  from the unauthorized access, use, disclosure, disruption, modification, or  destruction of information and information systems;   policies and procedures that (1) are based on risk assessments, (2) cost- effectively reduce information security risks to an acceptable level, (3)  ensure that information security is addressed throughout the life cycle of  each system, and (4) ensure compliance with applicable requirements;   plans for providing adequate information security for networks, facilities,    security awareness training to inform personnel of information security  risks and of their responsibilities in complying with agency policies and  procedures, as well as training personnel with significant security  responsibilities for information security;    periodic testing and evaluation of the effectiveness of information security  policies, procedures, and practices, to be performed with a frequency  depending on risk, but no less than annually, and that includes testing of  management, operational, and technical controls for every system  identified in the agency’s required inventory of major information systems;   a process for planning, implementing, evaluating, and documenting  remedial action to address any deficiencies in its information security  policies, procedures, or practices; and   plans and procedures to ensure continuity of operations for information  systems that support the operations and assets of the agency. To bolster security over its networks and  systems and to address its information security weaknesses, IRS has  developed various initiatives. However, one application’s system security  plan did not describe controls in place in the current environment. Although IRS has processes in place intended to monitor, test, and  evaluate its security policies and procedures, these processes were not  always effective. For example, IRS did not:    Detect many of the readily identifiable vulnerabilities we are reporting. In addition, during fiscal year 2010, IRS made  progress toward correcting previously reported information security  weaknesses, correcting or mitigating 23 of the 88 previously identified  weaknesses that were unresolved at the end of our prior audit. However,  at the time of our review, 65 of 88—about 74 percent—of the previously  reported weaknesses remained unresolved or unmitigated. The  agency informed us that it had corrected 39 of the 88 previously reported  weaknesses, but we determined that IRS had not fully implemented the  remedial actions for 16 of the 39 weaknesses that it considered corrected. Until IRS takes these further steps, financial and taxpayer information are  at increased risk of unauthorized disclosure, modification, or destruction;  financial data is at increased risk of errors that result in misstatement; and  the agency’s management decisions may be based on unreliable or  inaccurate financial information. We are also making 32 detailed recommendations in a separate report with  limited distribution. Further, he stated that IRS will provide a detailed corrective action plan  addressing each of our recommendations. This report contains recommendations to you. Appendix I: Objective, Scope, and Methodology

The objective of our review was to determine whether controls over key  financial and tax processing systems were effective in protecting the  confidentiality, integrity, and availability of financial and sensitive  taxpayer information at the Internal Revenue Service (IRS). To do this, we  examined IRS information security policies, plans, and procedures; tested  controls over key financial applications; and interviewed key agency  officials in order to (1) assess the effectiveness of corrective actions taken  by IRS to address weaknesses we previously reported and (2) determine  whether any additional weaknesses existed.
Why GAO Did This Study

The Internal Revenue Service (IRS) has a demanding responsibility in collecting taxes, processing tax returns, and enforcing the nation's tax laws. It relies extensively on computerized systems to support its financial and mission-related operations and on information security controls to protect financial and sensitive taxpayer information that resides on those systems. As part of its audit of IRS's fiscal years 2010 and 2009 financial statements, GAO assessed whether controls over key financial and tax processing systems are effective in ensuring the confidentiality, integrity, and availability of financial and sensitive taxpayer information. To do this, GAO examined IRS information security policies, plans, and procedures; tested controls over key financial applications; and interviewed key agency officials at four sites.

What GAO Found

Although IRS made progress in correcting previously reported information security weaknesses, control weaknesses over key financial and tax processing systems continue to jeopardize the confidentiality, integrity, and availability of financial and sensitive taxpayer information. Specifically, IRS did not consistently implement controls that were intended to prevent, limit, and detect unauthorized access to its financial systems and information. For example, the agency did not sufficiently (1) restrict users' access to databases to only the access needed to perform their jobs; (2) secure the system it uses to support and manage its computer access request, approval, and review processes; (3) update database software residing on servers that support its general ledger system; and (4) enable certain auditing features on databases supporting several key systems. In addition, 65 of 88--about 74 percent--of previously reported weaknesses remain unresolved or unmitigated. An underlying reason for these weaknesses is that IRS has not yet fully implemented key components of its comprehensive information security program. Although IRS has processes in place intended to monitor and assess its internal controls, these processes were not always effective. For example, IRS's testing did not detect many of the vulnerabilities GAO identified during this audit and did not assess a key application in its current environment. Further, the agency had not effectively validated corrective actions reported to resolve previously identified weaknesses. Although IRS had a process in place for verifying whether each weakness had been corrected, this process was not always working as intended. For example, the agency reported that it had resolved 39 of the 88 previously identified weaknesses; however, 16 of the 39 weaknesses had not been mitigated. IRS has various initiatives underway to bolster security over its networks and systems; however, until the agency corrects the identified weaknesses, its financial systems and information remain unnecessarily vulnerable to insider threats, including errors or mistakes and fraudulent or malevolent acts by insiders. As a result, financial and taxpayer information are at increased risk of unauthorized disclosure, modification, or destruction; financial data is at increased risk of errors that result in misstatement; and the agency's management decisions may be based on unreliable or inaccurate financial information. These weaknesses, considered collectively, are the basis for GAO's determination that IRS had a material weakness in internal control over financial reporting related to information security in fiscal year 2010.

What GAO Recommends

GAO recommends that IRS take eight actions to fully implement key components of its comprehensive information security program. In a separate report with limited distribution, GAO is recommending 32 specific actions for correcting newly identified control weaknesses. In commenting on a draft of this report, IRS agreed to develop a detailed corrective action plan to address each recommendation.