GAO: IRS Lacks Adequate Internal Controls

The Government Accountability Office yesterday released Financial Audit: IRS’s Fiscal Years 2013 and 2012 Financial Statements:

In GAO’s opinion, the Internal Revenue Service’s (IRS) fiscal years 2013 and 2012 financial statements are fairly presented in all material respects. However, in GAO’s opinion, IRS did not maintain effective internal control over financial reporting as of September 30, 2013, because of a continuing material weakness in internal control over unpaid tax assessments. ...

During fiscal year 2013, IRS continued to make important progress in addressing deficiencies in internal control over its financial reporting systems. However, new and continuing deficiencies in internal control that GAO identified over information security, including missing security updates, insufficient monitoring of financial reporting systems, and weak encryption for authentication, constituted a significant deficiency in IRS’s internal control. Until IRS fully addresses existing control deficiencies over its financial reporting systems, there is an increased risk that its financial and taxpayer data will remain vulnerable to inappropriate and undetected use, modification, or disclosure.

In addition to its internal control deficiencies, IRS faces significant ongoing financial management challenges associated with (1) safeguarding the large volume of sensitive hard copy taxpayer receipts and related information, and (2) its exposure to significant improper refunds from identity theft.