IRS Is the Tax Collector for the United States

IRS has demanding responsibilities in collecting taxes, processing tax  returns, and enforcing federal tax laws, and relies extensively on  computerized systems to support its financial and mission-related  operations. IRS Has Made Progress, but Control Weaknesses Continue to Place Financial and Taxpayer Information at Risk

Despite IRS’s efforts, weaknesses in controls over key financial and tax- processing systems continue to jeopardize the confidentiality, integrity,  and availability of financial and taxpayer information. Specifically, IRS  continues to face challenges in controlling access to its information  resources. In addition,  outdated and unsupported software exposes IRS to known vulnerabilities,  and shortcomings in performing system backup place the availability of  data at risk. However, IRS did not fully implement effective controls  in these areas. FISMA  requires each agency to develop, document, and implement an  information security program that, among other things, includes periodic assessments of the risk and magnitude of harm that could  result from the unauthorized access, use, disclosure, disruption,  modification, or destruction of information and information systems; policies and procedures that (1) are based on risk assessments, (2)  cost-effectively reduce information security risks to an acceptable  level, (3) ensure that information security is addressed throughout the  life cycle of each system, and (4) ensure compliance with applicable  requirements; plans for providing adequate information security for networks,  facilities, and systems;  security awareness training to inform personnel of information security  risks and of their responsibilities in complying with agency policies  and procedures, as well as training personnel with significant security  responsibilities for information security; periodic testing and evaluation of the effectiveness of information  security policies, procedures, and practices, to be performed with a  frequency depending on risk, but no less than annually, and that  includes testing of management, operational, and technical controls  for every system identified in the agency’s required inventory of major  information systems; and a process for planning, implementing, evaluating, and documenting  remedial action to address any deficiencies in its information security  policies, procedures, or practices. However, despite establishing a comprehensive framework for its  information security program, IRS has not fully implemented all  components of its program. Nevertheless, IRS indicated that it had not yet implemented this  recommendation. IRS had a process in place to evaluate and track remedial actions and  had developed remedial action plans to address previously reported  weaknesses, but it did not promptly correct known vulnerabilities, and its  process was not always working as intended. For example, the agency  indicated that 76 of the 105 previously reported weaknesses open at the  end of our prior-year audit had not yet been corrected. In addition, it did  not always validate that its actions to resolve known weaknesses were  effectively implemented. More specifically, of the 29 weaknesses IRS  indicated were corrected, we determined that 13 (about 45 percent) had  not yet been fully addressed. Conclusions

Although IRS implemented numerous controls and procedures intended  to protect key financial and tax-processing systems, control weaknesses  continue to jeopardize the confidentiality, integrity, and availability of  financial and sensitive taxpayer information. The new and unresolved deficiencies from previous audits, along with a  lack of fully effective compensating and mitigating controls, impair IRS’s  ability to ensure that its financial and taxpayer information is secure from  internal threats, reducing its assurance that its financial statements and  other financial information are fairly presented or reliable and that sensitive  IRS and taxpayer information is being sufficiently safeguarded from  unauthorized disclosure and modification. These deficiencies are the basis  of our determination that IRS had a material weakness in internal control  over financial reporting related to information security in fiscal year 2011. Recommendations for Executive Action

In addition to implementing our previous recommendations, we are  recommending that the Commissioner of Internal Revenue take the  following six actions to fully implement key components of the IRS  comprehensive information security program: document a baseline configuration standard for tasks initiated on the document monitoring procedures that staff use to review audit logs for  a key financial system;  fully document monitoring procedures for the procurement system,  specifically, supervisory review procedures to ensure access  privileges are appropriate for segregation of duties; expand tests associated with the agency’s enterprise continuous  monitoring process to include tests of access controls and system  tests, such as testing the system’s configuration, where appropriate,  to ensure comprehensive testing of key controls for financial and tax- related systems;  implement a compliance verification application to ensure appropriate  security patches have been applied in the UNIX environment; and  implement a compliance verification application, or other appropriate  process, to ensure configuration policies are comprehensively tested  on the mainframe. We are also making 23 detailed recommendations in a separate report  with limited distribution. However,  as we noted in this report, although IRS has provided a comprehensive  framework for its information security program, an underlying reason for  the information security weaknesses in IRS’s financial and tax-processing  systems is that it has not yet fully implemented critical components of its  comprehensive information security program. This work was performed in  connection with our audit of IRS’s fiscal years 2011 and 2010 financial  statements for the purpose of supporting our opinion on internal control  over the preparation of those statements.
Why GAO Did This Study

The Internal Revenue Service (IRS) has a demanding responsibility in collecting taxes, processing tax returns, and enforcing the nations tax laws. It relies extensively on computerized systems to support its financial and mission-related operations and on information security controls to protect financial and sensitive taxpayer information that resides on those systems.
As part of its audit of IRSs fiscal years 2011 and 2010 financial statements, GAO assessed whether controls over key financial and tax-processing systems are effective in ensuring the confidentiality, integrity, and availability of financial and sensitive taxpayer information. To do this, GAO examined IRS information security policies, plans, and procedures; tested controls over key financial applications; and interviewed key agency officials at seven sites.

What GAO Found

IRS implemented numerous controls and procedures intended to protect key financial and tax-processing systems; nevertheless, control weaknesses in these systems continue to jeopardize the confidentiality, integrity, and availability of the financial and sensitive taxpayer information processed by IRSs systems. Specifically, the agency continues to face challenges in controlling access to its information resources. For example, it had not always (1) implemented controls for identifying and authenticating users, such as requiring users to set new passwords after a prescribed period of time; (2) appropriately restricted access to certain servers; (3) ensured that sensitive data were encrypted when transmitted; (4) audited and monitored systems to ensure that unauthorized activities would be detected; or (5) ensured management validation of access to restricted areas. In addition, unpatched and outdated software exposed IRS to known vulnerabilities, and the agency had not enforced backup procedures for a key system.
An underlying reason for these weaknesses is that IRS has not fully implemented a comprehensive information security program. IRS has established a comprehensive framework for such a program, and has made strides to address control deficienciessuch as establishing working groups to identify and remediate specific at-risk control areas; however, it has not fully implemented all key components of its program. For example, IRSs security testing and monitoring continued to not detect many of the vulnerabilities GAO identified during this audit. IRS also did not promptly correct known vulnerabilities. For example, the agency indicated that 76 of the 105 previously reported weaknesses open at the end of GAOs prior year audit had not yet been corrected. In addition, IRS did not always validate that its actions to resolve known weaknesses were effectively implemented. Although IRS had a process in place for verifying whether each weakness had been corrected, this process was not always working as intended. Of the 29 weaknesses IRS indicated were corrected, GAO determined that 13 (about 45 percent) had not yet been fully addressed.
Considered collectively, these deficiencies, both new and unresolved from previous GAO audits, along with a lack of fully effective compensating and mitigating controls, impair IRS's ability to ensure that its financial and taxpayer information is secure from internal threats. This reduces IRS's assurance that its financial statements and other financial information are fairly presented or reliable and that sensitive IRS and taxpayer information is being sufficiently safeguarded from unauthorized disclosure or modification. These deficiencies are the basis of GAOs determination that IRS had a material weakness in internal control over financial reporting related to information security in fiscal year 2011.

What GAO Recommends

GAO recommends that IRS take 6 actions to fully implement key components of its comprehensive information security program. In a separate report with limited distribution, GAO is recommending that IRS take 23 specific actions to correct newly identified control weaknesses. In commenting on a draft of this report, IRS agreed to develop a detailed corrective action plan to address each recommendation.