IRS Is the Tax Collector for the United States

IRS collects taxes, processes tax returns, and enforces federal tax laws. IRS relies extensively on computerized  systems to support its financial and mission-related operations. However, IRS did not fully implement effective controls  in these areas. IRS has made progress in its implementation of data encryption controls,  particularly in protecting sensitive information transmitted across its  internal network. For fiscal year 2012, this office continued to implement new  procedures building on its initiatives. IRS Had Developed an Information Security Program but Had Not Always Effectively Implemented Elements of the Program

A key reason for the information security weaknesses in IRS’s financial  and tax-processing systems was that, although the agency has  developed and documented a comprehensive agencywide information  security program, it had not effectively implemented certain elements of  its information security program. FISMA requires each  agency to develop, document, and implement an information security  program that, among other things, includes periodic assessments of the risk and magnitude of harm that could  result from the unauthorized access, use, disclosure, disruption,  modification, or destruction of information and information systems; policies and procedures that (1) are based on risk assessments, (2)  cost-effectively reduce information security risks to an acceptable  level, (3) ensure that information security is addressed throughout the  life cycle of each system, and (4) ensure compliance with applicable  requirements; plans for providing adequate information security for networks,  facilities, and systems;  security awareness training to inform personnel of information security  risks and of their responsibilities in complying with agency policies  and procedures, as well as training personnel with significant security  responsibilities for information security; periodic testing and evaluation of the effectiveness of information  security policies, procedures, and practices, performed with a  frequency depending on risk, but no less than annually, and that  include testing of management, operational, and technical controls for  every system identified in the agency’s required inventory of major  information systems; a process for planning, implementing, evaluating, and documenting  remedial action to address any deficiencies in its information security  policies, procedures, or practices; and procedures for detecting, reporting, and responding to security  incidents. However, for one financial reporting system that we reviewed, the  testing methodology did not always determine whether required  authentication controls were operating effectively. Consequently, we identified control weaknesses that had  not been detected by IRS. However, we  determined that 13 (about 22 percent) of the 58 had actually not yet  been fully resolved. Conclusions

IRS has continued to make important progress in addressing information  security control weaknesses, and in improving its internal control over  financial reporting. During fiscal year 2012, IRS management devoted  attention and resources to addressing information security controls, and  resolved a significant number of the information security control  deficiencies that we have previously reported. Nevertheless, information  security weaknesses remain in access and other information system  controls over IRS’s financial and tax-processing systems, affecting the  confidentiality, integrity, and availability of financial and sensitive taxpayer  data. These deficiencies are the basis of our  determination that IRS had a significant deficiency in internal control over  financial reporting related to information security in fiscal year 2012. Continued and consistent management commitment and attention to an  effective information security program will be essential to the  maintenance of, and continued improvements in, the agency’s information  security controls. Recommendations for Executive Action

In addition to implementing our previous recommendations, we are  recommending that the Acting Commissioner of Internal Revenue take  the following four actions to effectively implement key components of the  IRS information security program:
Update policies and procedures to ensure that they address (1) both  methods available for granting all users access to mainframe  resources, (2) audit and monitoring of access from one processing  environment to another, (3) use of appropriate accounts by multiple  databases on a single server, (4) data storage shared between  systems, (5) out-of-date security standards, and (6) reconciliation of  access privileges; update test and evaluation methodology to ensure that it determines  whether authentication controls are operating effectively; update mainframe test and evaluation processes to improve periodic  monitoring of compliance with IRS policies; and  fully document a continuous monitoring strategy that includes  requirements and activities definitions at each organizational tier. We are also making 30 detailed recommendations in a separate report  with limited distribution. However, as we noted in this report, although IRS  has continued to make important progress in addressing information  security control weaknesses, it had not always effectively implemented  access and other controls to protect the confidentiality, integrity, and  availability of its financial systems and information. Appendix I: Objective, Scope, and Methodology

The objective of our review was to determine whether controls over key  financial and tax-processing systems were effective in protecting the  confidentiality, integrity, and availability of financial and sensitive taxpayer  information at the Internal Revenue Service (IRS). To do this, we  examined IRS information security policies, plans, and procedures; tested  controls over key financial applications; and interviewed key agency  officials in order to (1) assess the effectiveness of corrective actions taken  by IRS to address weaknesses we previously reported and (2) determine  whether any additional weaknesses existed.
Why GAO Did This Study

The Internal Revenue Service (IRS) has a demanding responsibility in collecting taxes, processing tax returns, and enforcing the nation's tax laws. It relies extensively on computerized systems to support its financial and mission-related operations and on information security controls to protect the financial and sensitive taxpayer information that resides on those systems.
As part of its audit of IRS's fiscal years 2012 and 2011 financial statements, GAO assessed whether controls over key financial and tax-processing systems are effective in ensuring the confidentiality, integrity, and availability of financial and sensitive taxpayer information. To do this, GAO examined IRS information security policies, plans, and procedures; tested controls over key financial applications; and interviewed key agency officials at eight sites.

What GAO Found

IRS continued to make progress in addressing information security control weaknesses, improving its internal control over financial reporting. During fiscal year 2012, IRS management devoted attention and resources to addressing information security controls, and resolved a significant number of the information security control deficiencies that GAO previously reported. Notable among these efforts were the (1) formation of cross-functional working groups tasked with the identification and remediation of specific at-risk control areas, (2) improvement in controls over the encryption of data transferred between accounting systems, and (3) upgrades to critical network devices on the agency's internal network system. However, serious weaknesses remain that could affect the confidentiality, integrity, and availability of financial and sensitive taxpayer data. For example, the agency had not always (1) implemented effective controls for identifying and authenticating users, such as enforcing password complexity on certain servers; (2) appropriately restricted access to its mainframe environment; (3) effectively monitored the mainframe environment; or (4) ensured that current patches had been installed on systems to protect against known vulnerabilities.
An underlying reason for these weaknesses is that IRS has not effectively implemented portions of its information security program. The agency has established a comprehensive framework for the program, and continued to make strides with various initiatives designed to improve its controls; however, certain components of the program did not always function as intended. For example, IRS's testing procedures over a financial reporting system that GAO reviewed did not always determine whether required controls were operating effectively and consequently, GAO identified control weaknesses that had not been detected by IRS. In addition, the agency had not updated an important policy concerning security standards for IRS's main tax processing environment to include current software versions and control capabilities. Further, although IRS indicated that it had addressed 58 of the previous information system security-related recommendations GAO made, 13 (about 22 percent) of the 58 had actually not yet been fully resolved. Continued and consistent management commitment and attention to an effective information security program will be essential to the maintenance of, and continued improvements in, its information system controls. Until IRS takes additional steps to (1) more effectively implement its testing and monitoring capabilities, (2) ensure that policies and procedures are updated, and (3) address unresolved and newly identified control deficiencies, its financial and taxpayer data will remain vulnerable to inappropriate use, modification, or disclosure, possibly without being detected. These deficiencies, along with shortcomings in the information security program, were the basis of GAO's determination that IRS had a significant deficiency in its internal control over financial reporting systems for fiscal year 2012.

What GAO Recommends

GAO recommends that IRS take four actions to more effectively implement portions of its information security program. In a separate report with limited distribution, GAO is recommending that IRS take 30 specific actions to address newly identified control weaknesses. In commenting on a draft of this report, IRS agreed to develop a detailed corrective action plan to address each recommendation.