The Modernization, Information Technology and  Security Services (MITS) PMO leads IT development for the program. The Health Care Counsel provides legal counsel and guidance (see fig. IRS Has Made Varying Degrees of Progress in Implementing Our Recommendations but Has More to Do on Project Planning, Cost Estimating, and Evaluating Risk Mitigation Strategies

Over half of the 47 provisions requiring action from IRS were statutorily  effective in or prior to 2010, forcing IRS to conduct short-term  implementations and long-term strategic planning simultaneously. These efforts  have helped IRS gain a better understanding and vision for the  implementation work and challenges remaining and how IRS would  manage risks to the program’s success. IRS has implemented one of our four recommendations from June 2011  to strengthen PPACA implementation efforts by documenting a schedule  for developing performance measures for PPACA that are to link to  program goals (see table 2). Our June 2012 report on IRS’s fiscal  year 2013 budget recommended that IRS revise its PPACA cost estimate  by September 2012, which IRS agreed to do. IRS’s Risk Management Plan Meets Criteria for Three of Five Risk Framework Stages but Lacks Specific Guidance on the Evaluation and Selection of Mitigation Strategies

Our assessment of IRS’s revised risk management plan from   February 24, 2012, indicated that IRS adheres to the criteria for three of  the five stages of our framework for risk management. While this may be true, IRS’s risk plan does not offer  guidance on factors like the probability of a risk’s occurrence that could  affect the level of evaluation and amount of documentation to be done. IRS provided evidence of a  weekly review meeting for risks. IRS officials acknowledged that the risk  plan was not used for these provisions, noting that the provisions were  not expected to have an impact on IRS operations. However,  IRS did not have a formal system for managing risks when coordinating  with HHS. IRS officials said that they received  informal feedback from conversations with other tax stakeholders, such  as groups representing taxpayers, tax software developers, and tax  preparers. Additionally, without a shared  system for tracking and monitoring risks with partner agencies, such as  HHS, the agencies will be more likely to overlook potential challenges or  duplicate efforts to mitigate risks. Recommendations for Executive Action

To strengthen the PPACA risk management plan, we recommend that the  Commissioner of Internal Revenue enhance guidance on evaluating risk  mitigation alternatives to   clarify who is responsible for doing the evaluation and making  decisions based on the results as well as how they might do the  evaluation, assure that resources are available for the chosen mitigation strategy, document the mitigation alternatives considered and rationale(s) for  the decisions made. To ensure more consistent implementation of the risk management plan,  we recommend that the Commissioner of Internal Revenue take the  following two actions: ensure that the PPACA risk management plan is applied to provisions  in which the Office of Chief Counsel assumes lead responsibility for  implementation, and develop agreements with HHS (and other external parties as needed)  on a system to record and track details on decisions made or to be  made to ensure that risks are identified and mitigated. To assess IRS’s risk management plan for PPACA, we compared the  contents of IRS’s Risk Management Plan, governance plan, and high- level action plans to the criteria outlined by GAO’s risk management  approach. Appendix III: Provisions Evaluated for Consistent Use of Risk Management Plan

In evaluating IRS’s responses to a sample of nine PPACA provisions, we  found that IRS generally followed the plan to identify, track and report  risks. As discussed in our report, exceptions were (1) IRS did not  consistently evaluate potential risk mitigation strategies in the  Resolution/Mitigation stage of its risk plan, and (2) the risk plan was not  used when the Office of Chief Counsel led the implementation of  provisions related to a reinsurance program for early retirees and the  economic substance doctrine. Patient Protection and Affordable Care Act: IRS Should Expand Its  Strategic Approach to Implementation.
Why GAO Did This Study

PPACA is a significant effort for IRS, with expected costs of $881 million from fiscal years 2010 to 2013 and work planned through 2018. To implement PPACA, IRSmust work closely with partner agencies to develop information technology systems that can share data with other agencies. Additionally, IRS is responsible for providing guidance to taxpayers, employers, insurers, and others to ensure compliance with new tax aspects of the law. Furthermore, it will be important for IRS to have systems to consistently identify, assess, mitigate, and monitor potential risks to the programs success.
As requested, this report (1) describes IRSs progress in addressing GAO recommendations from June 2011 on PPACA implementation, (2) assesses IRSs revised risk management plan, and (3) assesses how IRS applies its plan in practice. GAO compared IRSs revised risk plan to GAOs criteria for risk management and selected 9 provisions of the law in which IRS had a role to determine whether IRS used the risk plan consistently. Because selection focused on provisions that had the most risks and highest dollar impacts, the results are not generalizable but are relevant to how IRS managed risks.

What GAO Found

The Internal Revenue Service (IRS) has implemented one of GAOs four recommendations from June 2011 to strengthen the Patient Protection and Affordable Care Act (PPACA) implementation efforts by scheduling the development of performance measures for the PPACA program. IRS has made varying degrees of progress on the other three recommendations:
develop program goals and an integrated project plan;
develop a cost estimate consistent with GAOs published guidance; and
assure that IRSs risk management plan identifies strategic level risks and evaluates associated mitigation options.
IRSs revised risk management plan meets three of five criteria for risk management plans, but the plan does not have specific guidance for evaluating and selecting potential risk mitigation options, such as how to
identify who conducts and reviews the analysis,
determine the availability of resources for a given strategy, and
document for future users the rationale behind decisions made.
IRS applied its risk management plan when identifying, tracking, and reporting on implementation risks. Although the risk plan calls for risk mitigation strategies to be evaluated, these evaluations have not been done. IRS officials said that evaluating these strategies would require varying levels of effort because the probability and magnitude of risks differ. However, the plan was silent on this point; it provided no guidance as to when and to what extent an evaluation should be done. Without evaluating potential strategies, IRS may not consider critical factors that impact the programs success.
IRSs risk management plan was not used when IRSs Office of Chief Counsel was responsible for implementing two provisions GAO reviewed. Although these provisions primarily required legal counsel and guidance, IRS officials said that one of the provisions also affected IRS operations and could have risks that need to be managed. Additionally, GAO did not find evidence that a risk plan was used to track and mitigate risks when coordinating with partner agencies, such as the Department of Health and Human Services. Without a system for tracking shared risks, IRS is more likely to overlook risks or duplicate efforts.

What GAO Recommends

GAO recommends that IRS (1) enhance its guidance on evaluating risk mitigation alternatives and documenting decisions, (2) use a risk management plan for work led by its Office of Chief Counsel, and (3) develop agreements with external parties to record and track risks that threaten shared goals and objectives. IRS officials agreed with all of GAOs recommendations.