One entity is the ISAC Partnership, a collaborative  organization run jointly by IRS, states, and industry partners. IRS’s goal  is to convene the call within 24 to 72 hours after an incident is discovered. IRS Has Taken Significant Actions to Facilitate Information Sharing through the ISAC and RRT

IRS implemented the ISAC in 2017 to facilitate information sharing among  IRS, state, and industry partners—subject to disclosure prohibitions—by  launching an online platform, establishing a governance structure, and  recruiting members. As of  November 2017, the ISAC had 24 full state members, 7 alerts-only state  members, 14 tax preparation company members, and 3 financial  institution members. Likewise, in the focus groups, industry officials cited benefits of  improved coordination from the Security Summit. IRS Established the RRT in 2016 and Initiated the RRT Process Once in the 2017 Filing Season

As part of establishing the RRT, IRS outlined the responsibilities of IRS,  states, and industry to respond to significant IDT refund fraud incidents. The ISAC Pilot Partially Aligns with Leading Practices for Pilot Design, but IRS Does Not Have a Plan to Improve Alignment

In 2016, we identified five leading practices for designing a well- developed and documented pilot program: (1): ensuring stakeholder  communication, (2) establishing objectives, (3) ensuring scalability, (4)  having an assessment methodology, and (5) developing a data-analysis  plan. While the ISAC pilot is in nascent stages, IRS has taken steps that  partially align with key aspects of all five leading practices. Despite these efforts, IRS’s message about the ISAC’s benefits has not  fully reached states. While IRS has taken steps to reach out to state and  industry partners, IRS and the ISAC Partnership have opportunities to  more fully engage stakeholders. However, officials from all states  represented in our focus groups noted that they either had not used, or  were unfamiliar with, the ISAC-specific resources—such as the data  visualization tools shown previously in figure 4. These are intended to  help users identify IDT refund fraud trends more broadly. Although the ISAC Partnership does not have an outreach plan, such a  plan could, for example, address how to expand ISAC membership or the  disconnect between the benefits identified by the ISAC Board and how  states perceive the ISAC can be used to prevent and detect fraud in their  states. For the ISAC, this could mean less effective collaboration among  stakeholders or missed opportunities to prevent IDT refund fraud. Among these efforts, the ISAC  and RRT show promise for increasing information sharing and  collaboration among IRS, states, and industry to help detect and prevent  IDT refund fraud and coordinate responses to fraud incidents. Further, IRS has not developed criteria for assessing whether  the pilot’s objectives have been met. Without this assessment and better  alignment with leading practices for pilot design, IRS, its partners, and  Congress will have difficulty determining the effectiveness of the pilot and  whether and when to proceed with full-scale implementation. (Recommendation 1)
The Acting Commissioner of Internal Revenue should ensure that the  ISAC Partnership develops an outreach plan to expand membership and  improve states’ and industry partners’ understanding of the ISAC’s  benefits. IRS reported it will be finalizing an  Identity Theft Tax Refund Fraud Pilot Management Plan to help it better  align the ISAC pilot with leading practices for pilot design. Additionally,  IRS reported it will work with the ISAC Board to ensure that the Board  develops an outreach plan to expand membership and improve states'  and industry partners' understanding of the ISAC's benefits. Appendix I: Objectives, Scope, and Methodology

The objectives of this engagement were to (1) describe actions Security  Summit partners are taking to implement an Information Sharing and  Analysis Center (ISAC) and a Rapid Response Team (RRT); (2) evaluate  the extent to which the ISAC pilot design aligns with leading practices;  and (3) identify actions, if any, that the Internal Revenue Service (IRS)  could take to improve the ISAC pilot.
Why GAO Did This Study

IRS estimates that fraudsters attempted at least $14.5 billion in IDT tax refund fraud in tax year 2015. Since 2015, GAO's High-Risk List has included IRS's efforts to address IDT refund fraud. Starting with its March 2015 Security Summit, IRS has partnered with state tax administrators and tax preparation companies, among others, on initiatives aimed at better preventing and detecting IDT refund fraud.
GAO was asked to examine IRS's efforts to collaborate with these partners. This report, among other things, (1) describes actions taken to implement the ISAC and RRT, (2) evaluates the extent to which the ISAC pilot aligns with leading practices for pilot design, and (3) identifies actions, if any, that IRS could take to improve the ISAC pilot.
GAO reviewed planning and other documents on the initiatives. It interviewed IRS and state officials and industry and trade organization representatives, among others involved in the ISAC and RRT. GAO also conducted four non-generalizable focus groups with state and industry partners.

What GAO Found

The Internal Revenue Service (IRS) launched an Identity Theft Tax Refund Fraud Information Sharing and Analysis Center (ISAC) pilot for the 2017 filing season. It aims to allow IRS, states, and tax preparation industry partners to quickly share information on identity theft (IDT) refund fraud. The ISAC pilot includes two components: an online platform run by IRS to communicate data on suspected fraud, and an ISAC Partnership, a collaborative organization comprised of IRS, states, and industry, which is intended to be the governance structure. As of November 2017, the ISAC had 48 members: 31 states (including full members and those receiving alerts only), 14 tax preparation companies, and 3 financial institutions. In addition, IRS is using a Rapid Response Team (RRT) in partnership with states and industry members to coordinate responses to IDT refund fraud incidents that pose a significant threat within 24 to 72 hours of being discovered. IRS deployed the RRT for six incidents in 2016 and once in 2017.
GAO found that the ISAC pilot aligns with key aspects of all five leading practices for effective pilot design GAO previously identified, but none fully. For example, IRS has worked to incorporate stakeholder input, but its message about the ISAC's benefits has not fully reached states. Further, IRS does not have criteria for assessing whether the pilot's objectives have been met. Without this assessment and better alignment with leading practices, IRS, its partners, and Congress will have difficulty determining the effectiveness of the pilot and whether to implement it more broadly.
IRS has taken actions to improve the ISAC pilot, but the ISAC Partnership does not have an outreach plan. While the ISAC Senior Executive Board limited industry participation to partners who participated in its Security Summit, the ISAC has obtained support from trade organizations. However, officials from almost all states represented in our focus groups noted that they either had not used, or were unfamiliar with, the ISAC-specific resources. While the ISAC Board has taken steps to engage stakeholders, the ISAC Partnership does not have an outreach plan to increase membership and improve states' and industry partners' understanding of the ISAC's benefits. Without such a plan, less effective collaboration is likely among stakeholders and opportunities to prevent IDT refund fraud may be missed.

What GAO Recommends

GAO recommends IRS ensure (1) the ISAC better aligns with leading practices for effective pilot design, and (2) the ISAC Partnership develops an outreach plan to expand membership and improve understanding of the ISAC's benefits. IRS and the ISAC Board state and industry co-chairs agreed with the recommendations.