In 2016, IAO led an effort that  identified over 100 interactions between IRS and taxpayers that require  authentication and categorized these interactions based on potential risks  to the agency and taxpayers. IRS Has Begun to Implement Its Authentication Strategy, but Has Not Articulated Priorities and Resource Needs

In its Roadmap, IRS outlined six core authentication objectives, 10 high- level strategic efforts, and 14 foundational initiatives to help it address  authentication challenges and identify opportunities for future investment. While we found that IRS has made progress on some efforts identified in  its Roadmap, it has not prioritized the initiatives supporting its strategy nor  identified the resources required to complete them, consistent with  program management leading practices. Additional Actions Could Help IRS Enhance Security and Stay Ahead of Fraudsters

Given the widespread availability of personally identifiable information  that fraudsters can use to perpetrate tax fraud, it is essential for IRS to  further strengthen taxpayer authentication to stay ahead of fraudsters’  schemes. First, we found that IRS has taken preliminary steps to implement NIST’s  June 2017 guidance for secure online authentication, however it had not  yet established detailed plans, including timelines, milestone dates, and  resource needs to fully implement it. In short, following NIST’s new guidance will help provide IRS with better  risk-based assurance that the person trying to access IRS’s online  services is who they claim to be. Second, we found that IRS lacks a comprehensive, repeatable process to  identify and evaluate potential new authentication technologies and  approaches. These representatives advocate an approach  to authentication that relies on multiple strategies and sources of  information, while giving taxpayers options for further protecting their  information. To this end, we recommended that IRS develop a process to  identify and evaluate alternative options for improving taxpayer  authentication, including technologies in use by industry, states, or other  trusted partners; and based on this approach, include and prioritize these  options, as appropriate, in its Roadmap.
Why GAO Did This Study

This testimony summarizes the information contained in GAO's June 2018 report, entitled Identity Theft: IRS Needs to Strengthen Taxpayer Authentication Efforts ( GAO-18-418 ).

What GAO Found

The Internal Revenue Service (IRS) has identified over 100 interactions requiring taxpayer authentication based on potential risks to IRS and individuals. IRS authenticates millions of taxpayers each year via telephone, online, in person, and correspondence to ensure that it is interacting with legitimate taxpayers. IRS's estimated costs to authenticate taxpayers vary by channel.
IRS has made progress on monitoring and improving authentication, including developing an authentication strategy with high-level strategic efforts. However, it has not prioritized the initiatives supporting its strategy nor identified the resources required to complete them, consistent with program management leading practices. Doing so would help IRS clarify relationships between its authentication efforts and articulate resource needs relative to expected benefits. Further, while IRS regularly assesses risks to and monitors its online authentication applications, it has not established equally rigorous internal controls for its telephone, in-person, and correspondence channels, including mechanisms to collect reliable, useful data to monitor authentication outcomes. As a result, IRS may not identify current or emerging threats to the tax system.
IRS can further strengthen authentication to stay ahead of fraudsters. While IRS has taken preliminary steps to implement National Institute of Standards and Technology's (NIST) new guidance for secure digital authentication, it does not have clear plans and timelines to fully implement it by June 2018, as required by the Office of Management and Budget. As a result, IRS may not be positioned to address its most vulnerable authentication areas in a timely manner. Further, IRS lacks a comprehensive process to evaluate potential new authentication technologies. Industry representatives, financial institutions, and government officials told GAO that the best authentication approach relies on multiple strategies and sources of information, while giving taxpayers options for actively protecting their identity. Evaluating alternatives for taxpayer authentication will help IRS avoid missing opportunities for improving authentication.