It also  manages the distribution of over $400 billion in refunds. According to the agency, it spent  approximately $2.7 billion on its IT investments during fiscal year 2016. However, none of the  analyses addressed all key factors specified in OMB’s guidance. The Selected Investments in Development Spent Less than Planned, but Most Were Behind Schedule and Had Delivered Less Scope than Planned

Best practices highlight the importance of monitoring the performance of  projects in development by comparing actual cost, schedule, and scope  to plans in order to allow appropriate corrective actions if actual  performance deviates significantly from planned performance. IRS reported operational performance metrics, as required, for the five  selected investments we reviewed that were in the operations and  maintenance phase. The five selected investments that we reviewed in the operations and  maintenance phase performed operational analyses that addressed most,  but not all of these key factors identified in OMB guidance. Table 3 provides our  assessment of the investments’ operational analyses. Selected Legacy Investments Face Significant Risks and IRS Has Not Implemented Steps Needed to Effectively Manage These Risks

Three selected investments we reviewed—IMF, IDRS, and MSSS—are  facing significant risks due to their reliance on legacy programming  languages, outdated hardware, and a shortage of human resources with  critical skills. As we previously reported, reliance on assembly language code  and COBOL has risks, such as a rise in procurement and operating costs,  and a decrease in the availability of individuals with the proper skill sets. In addition, one investment in our review—MSSS—relies on a significant  amount of outdated hardware. IRS fully implemented one key risk management practice for IMF. Until IRS fully implements all of the key practices for managing risks, it  will be challenged to successfully identify and mitigate risks before they  adversely impact the agency’s ability to carry out its mission. The key IT workforce planning practices and supporting activities  are identified below. While IRS has initiated IT workforce planning efforts, the agency has not  yet implemented any of the four IT workforce planning practices. Specifically, we found that the Human Capital Office and IT organization  have collaboratively developed a tool to automate the IT workforce  planning process but the tool is in the initial stages of implementation and  IRS has not yet performed any of the activities associated with setting the  strategic direction for workforce planning. IRS officials attributed the limited progress in implementing IT workforce  planning practices to resource constraints and competing priorities. Nevertheless, until the agency implements these practices, it will continue  to face challenges in assessing and addressing the gaps in knowledge  and skills that are critical to the success of its key investments, some of  which we identified earlier in the report. By fully implementing key risk management practices, IRS  will have better assurance that it is proactively addressing risks before  they can impact the agency’s ability to carry out its mission. Appendix I: Objectives, Scope, and Methodology

Our objectives were to (1) evaluate the performance of selected Internal  Revenue Service (IRS) information technology (IT) investments, (2)  summarize any risks associated with selected legacy systems and  evaluate the steps IRS has taken to manage them, and (3) determine the  extent to which IRS has implemented key IT workforce planning  practices. In addition, we considered a mix of investments in development and  operations and maintenance. In addition, for the five operational investments, we compiled and  analyzed operational performance information reported for the selected  investments for fiscal year 2016 and the first 2 quarters of 2017; this  information included, where reported, the performance target and actual  results for each metric. To do so, we obtained operational  analyses for fiscal year 2016 and analyzed the analyses against relevant  practices outlined in the Office of Management and Budget’s (OMB) fiscal  year 2016 capital programming guidance.
Why GAO Did This Study

IRS relies extensively on IT investments to annually collect more than $3 trillion in taxes, distribute more than $400 billion in refunds, and carry out its mission of providing service to America's taxpayers in meeting their tax obligations. For fiscal years 2016 and 2017, the agency reported spending approximately $2.7 billion and $2.6 billion, respectively, for IT investments.
GAO was asked to review IRS's IT operations. GAO's specific objectives were to (1) evaluate the performance of selected IRS IT investments, (2) summarize any risks associated with selected legacy systems and evaluate the steps the agency has taken to manage such risks, and (3) determine the extent to which IRS has implemented key IT workforce planning practices.
GAO analyzed planned versus actual performance information for nine selected investments for fiscal year 2016 and the first 2 quarters of fiscal year 2017—four in development and five in the operations and maintenance phase; identified risks facing three legacy investments and analyzed IRS's efforts to manage these risks against key practices; and analyzed IRS's IT workforce planning efforts against best practices.

What GAO Found

The performance of the Internal Revenue Service's (IRS) selected information technology (IT) investments that GAO reviewed varied. Specifically, the four selected investments in the development phase that GAO reviewed spent less than planned, but most were behind schedule and delivered less scope than planned (see table below). In addition, the five selected investments in the operations and maintenance phase that GAO reviewed had performed internal qualitative assessments of performance as required by the Office of Management and Budget (OMB); however, none of the analyses addressed all key factors specified in OMB guidance.
Three investments GAO reviewed in the operations and maintenance phase that are legacy investments—Individual Master File (IMF), Integrated Data Retrieval System (IDRS), and Mainframes and Servers Services and Support (MSSS)— are facing significant risks due to their reliance on legacy programming languages, outdated hardware, and a shortage of human resources with critical skills. For example, IRS reported that it used assembly language code and Common Business Oriented Language (both developed in the 1950s) for IMF and IDRS, which exposes these investments to a rise in procurement and operating costs, and a decrease in staff available with the proper skill sets. Further, MSSS relies on a significant amount of outdated hardware exposing the investment to rising warranty and maintenance fees, as well as equipment failures. Despite these risks, the agency has not fully implemented key risk management practices and may be challenged in mitigating risks effectively so that they do not impact the agency's ability to carry out its mission.
IRS has not yet fully implemented any of the key IT workforce planning practices GAO has previously identified. Specifically, the agency has developed a tool to automate the IT workforce planning process, but the tool is in the initial stages of implementation. IRS officials attributed the limited progress in implementing IT workforce planning practices to resource constraints and competing priorities. Nevertheless, until the agency fully implements these practices, it will continue to face challenges in assessing and addressing the gaps in knowledge and skills that are critical to the success of its key IT investments.

What GAO Recommends

GAO recommends that IRS perform operational analyses consistent with guidance, implement key risk management practices, and fully implement key IT workforce planning practices. IRS did not agree or disagree with the recommendations, but said it would provide a plan for addressing each recommendation.