The increased number of seasonal staff IRS employs to handle and process this large volume of receipts and returns increases IRS’ vulnerability to theft. In addition to adequately safeguarding taxpayer receipts, it is equally important for IRS to protect sensitive taxpayer data. We recognize that due to the high volume and sensitive nature of IRS’ activities, particularly during the peak filing season, no system of internal control can eliminate the vulnerability of receipts and sensitive taxpayer information to theft. As a result, the vulnerability of this data to theft or misuse is heightened. Because of the length of time it takes, IRS only requires a background investigation for employees hired for periods of 90 days or more. These seasonal and temporary employees work an average of 8 to 10 weeks during the peak filing season, and may have already finished their term of employment before IRS receives the results of these fingerprint checks. If the results of fingerprint checks are not received promptly by IRS, these individuals can be placed in positions to steal receipts and taxpayer data. According to the internal audit review, of the 80 thefts of receipts at service centers reported between January 1995 and July 1997, 12 were committed by employees with previous arrest records for theft, assault, or drug charges that were not identified prior to employment. Physical Safeguards Are Inadequate to Protect Cash Receipts

The Comptroller General’s Standards for Internal Controls in the Federal Government requires that access to resources and records, such as IRS receipts and taxpayer data, be limited to authorized individuals in order to reduce the risk of unauthorized use or loss to the government. Because IRS service centers and district offices directly collected over $100 billion in fiscal year 1997 and are responsible for processing all taxpayer data submitted by taxpayers, such weaknesses increase the vulnerability of receipts and taxpayer data to theft or misuse. These receipts were stored overnight in a locked cabinet. Courier Security Does Not Adequately Protect Deposits and Sensitive Taxpayer Data From Theft or Loss

Proper safeguarding of assets requires that IRS ensure adequate security over receipts from the time they are received at the service center until the time they are deposited at financial depository institutions. During the peak filing season, one service center deposit typically has tens of thousands of checks. These actions include conducting an analysis of risk classifications of positions in the Receipt and Control Branch to ensure background checks are commensurate with the level of risk associated with the position; ensuring IRS has the necessary equipment to participate in the FBI’s Integrated Automated Fingerprint Identification System program by August 1999; working with each service center to determine appropriate methods for securing overflow areas and ensuring all final candling areas are located in restricted access areas; exploring various options for security containers for unmatched checks and implementing a process for such storage by August 1999; revising procedures to require stamping all returned refund checks “non-negotiable” as soon as they are extracted from envelopes; revising procedures for safeguarding receipts received in walk-in facilities and for maintaining a control log of receipts received and deposited or transferred to another unit by January 1999; and studying alternative methods for transporting deposits to depositories and service center practices for limiting courier access to service centers. GAO Comment

1.
Why GAO Did This Study

Pursuant to a legislative requirement, GAO reviewed the Internal Revenue Service's (IRS) physical controls over receipts and taxpayer data.

What GAO Found

GAO noted that: (1) IRS' controls over receipts and taxpayer data do not adequately reduce the vulnerability of the federal government and taxpayers to loss from theft; (2) this condition existed because of the length of time required to conduct background investigations, delays in receiving results of fingerprint checks, and processing demands which required the hiring of thousands of employees during the peak filing season; (3) placing new hires in sensitive positions prior to, at a minimum, receiving the results of fingerprint check increases the vulnerability of receipts and taxpayer data to theft; (4) in fact, of the 80 thefts IRS investigated at service centers from January 1995 to July 1997, 12 were committed by individuals who had previous arrest records that were not identified prior to their employment; (5) GAO also noted weaknesses in the physical controls over service center and district office receipts; (6) while service center receipts are required to be processed only by authorized individuals in the Receipt and Control Branch, which is a restricted access area, numerous receipts were found in unrestricted areas accessible to other IRS employees and to non-employees not authorized to handle receipts; (7) receipts particularly vulnerable to theft also were not adequately secured; (8) while it is important to adequately protect cash and checks received at IRS facilities, it is similarly essential to ensure that these receipts are properly protected during transport to depository institutions; (9) GAO found that single, unarmed couriers in ordinary civilian vehicles were used to transport IRS deposits totalling hundreds of millions of dollars to the depository institutions during the peak filing season; (10) the theft of one peak season deposit could place a significant administrative burden on IRS to contact taxpayers and initiate stop payment orders on tens of thousands of checks; (11) although receipts and taxpayer information will always be vulnerable to theft, IRS has a responsibility to protect the government and taxpayers from such losses; (12) many of the actions GAO is recommending to minimize these vulnerabilities and thus better protect taxpayer receipts and data would not result in significant costs, and several other actions GAO is recommending are already required by IRS policy or are currently under consideration by IRS management; and (13) IRS has prepared two corrective action plans to reduce its vulnerability to theft or loss of receipts and taxpayer data.