IRS verifies  that it is interacting with the legitimate taxpayer through identity proofing  and authentication. IRS Has Made Progress on Its Authentication Efforts, but Has Not Prioritized Authentication Improvements and Is Not Sufficiently Assessing and Monitoring Risks for All Channels

		IRS Has Begun to Implement Its Authentication Strategy, but Has Not Articulated Priorities and Resource Needs

IRS has identified high-level strategic campaigns, or efforts to enhance  identity assurance, in its Identity Assurance Strategy and Roadmap  (Roadmap) and has established a business process to support these  efforts. At the same time, clearly identifying resources and  prioritizing its initiatives and activities will help clarify the relationships  between IRS’s authentication efforts and resource needs relative to  expected benefits. IRS Lacks Internal Controls to Effectively Monitor Telephone, In- Person, and Correspondence Authentication

IRS has established internal controls including procedures and  mechanisms to monitor performance of online authentication, but does  not have similar controls in place to monitor the performance of  telephone, in-person, and correspondence authentication. As a result, IRS may be  challenged in identifying current and emerging threats to the tax system. IRS officials also noted that the agency has taken preliminary steps to  implement the new guidelines. However, without clear plans, timelines, and milestones for performing  this work, IRS may not be positioned to address the most vulnerable  areas in a timely manner. Further,  representatives from industry and financial institutions and government  officials with whom we spoke advocated a layered approach to  authentication that relies on multiple strategies and sources of  information, while giving taxpayers options for further protecting their  information. However, given the availability of PII and the prevalence  of cyberattacks, developing a repeatable, comprehensive process to  identify and evaluate alternative options for taxpayer authentication and  implementing improvements can help IRS ensure it is authenticating  taxpayers in the most secure manner. Conclusions

Each year, IRS authenticates millions of taxpayers via telephone, online,  in-person, or correspondence to verify potentially fraudulent tax returns,  provide taxpayers access to a tax transcript, or issue a replacement IP PIN. Given the widespread availability of PII that fraudsters can use to  perpetrate tax fraud, it is essential for IRS to strengthen taxpayer  authentication to stay ahead of fraudsters’ schemes. Further, developing a repeatable,  comprehensive process to identify and evaluate potential authentication  technologies and services will help IRS avoid missing opportunities for  improving authentication. IRS stated that  once it finalizes its authentication approach, it will estimate the resources  required for each initiative and prioritize them, consistent with our  recommendation. Further, IRS agreed with our recommendations to develop a plan for fully  implementing NIST’s new authentication guidance and make the  necessary improvements to its systems. Appendix I: Objectives, Scope, and Methodology

Our objectives were to (1) describe the taxpayer interactions that require  authentication, including the general rationale behind the requirements,  and the Internal Revenue Service’s (IRS) authentication methods; (2)  assess what IRS is doing to monitor and improve its authentication  methods, both internally and collaboratively through the Security Summit,  to secure taxpayer information and reduce identity theft refund fraud; and  (3) evaluate what else, if anything, IRS can do to strengthen its  authentication methods while improving services to taxpayers. To describe the interactions that require taxpayer authentication and  IRS’s methods to do so, we reviewed IRS documents, policies and  procedures, IRS data and information on the number of taxpayers  authenticated by channel, and interviewed knowledgeable IRS officials. We compared IRS’s efforts to applicable  activities in the Roadmap, IRS’s Strategic Plan Fiscal Years 2014-2017  (Strategic Plan), Standards for Internal Control in the Federal  Government, GAO’s Framework for Managing Fraud Risks in Federal  Programs, and relevant National Institute of Standards and Technology  (NIST) guidance.
Why GAO Did This Study

Strong preventive controls can help IRS defend itself against identity theft refund fraud. These controls include taxpayer authentication—the process by which IRS verifies identities before allowing people access to a resource; sensitive data; or, in some cases, a tax refund. The risk of fraud has increased as more personally identifiable information has become available as a result of, for example, large-scale cyberattacks on various entities. IRS's ability to continuously monitor and improve taxpayer authentication is a critical step in protecting billions of dollars from fraudsters.
GAO was asked to examine IRS's efforts to authenticate taxpayers. This report (1) describes the taxpayer interactions that require authentication and IRS's methods; (2) assesses what IRS is doing to monitor and improve taxpayer authentication; and (3) determines what else, if anything, IRS can do to strengthen taxpayer authentication in the future.
To meet these objectives, GAO reviewed IRS documents and data, evaluated IRS processes against relevant federal internal control standards and guidance, and interviewed IRS officials and state and industry representatives.

What GAO Found

The Internal Revenue Service (IRS) has identified over 100 interactions requiring taxpayer authentication based on potential risks to IRS and individuals. IRS authenticates millions of taxpayers each year via telephone, online, in person, and correspondence to ensure that it is interacting with legitimate taxpayers. IRS's estimated costs to authenticate taxpayers vary by channel.
IRS has made progress on monitoring and improving authentication, including developing an authentication strategy with high-level strategic efforts. However, it has not prioritized the initiatives supporting its strategy nor identified the resources required to complete them, consistent with program management leading practices. Doing so would help IRS clarify relationships between its authentication efforts and articulate resource needs relative to expected benefits. Further, while IRS regularly assesses risks to and monitors its online authentication applications, it has not established equally rigorous internal controls for its telephone, in-person, and correspondence channels, including mechanisms to collect reliable, useful data to monitor authentication outcomes. As a result, IRS may not identify current or emerging threats to the tax system.
IRS can further strengthen authentication to stay ahead of fraudsters. While IRS has taken preliminary steps to implement National Institute of Standards and Technology's (NIST) new guidance for secure digital authentication, it does not have clear plans and timelines to fully implement it by June 2018, as required by the Office of Management and Budget. As a result, IRS may not be positioned to address its most vulnerable authentication areas in a timely manner. Further, IRS lacks a comprehensive process to evaluate potential new authentication technologies. Industry representatives, financial institutions, and government officials told GAO that the best authentication approach relies on multiple strategies and sources of information, while giving taxpayers options for actively protecting their identity. Evaluating alternatives for taxpayer authentication will help IRS avoid missing opportunities for improving authentication.

What GAO Recommends

GAO is making 11 recommendations to IRS to estimate resources for and prioritize its authentication initiatives, address internal control issues to better monitor authentication, develop a plan to fully implement new NIST guidance, and develop a process to evaluate potential authentication technologies. IRS agreed with GAO's recommendations.