GAO: IRS Lacks Adequate Internal Controls

Government Accountability Office, IRS's Fiscal Years 2014 and 2013 Financial Statements (GAO-15-173):

In GAO's opinion, the Internal Revenue Service's (IRS) fiscal years 2014 and 2013 financial statements are fairly presented in all material respects. However, in GAO's opinion, IRS did not maintain effective internal control over financial reporting as of September 30, 2014, because of a continuing material weakness in internal control over unpaid tax assessments. ...

During fiscal year 2014, IRS continued to make important progress in addressing deficiencies in internal control over its financial reporting systems. However, GAO identified new and continuing deficiencies in internal control over information security, including missing security updates, insufficient monitoring of financial reporting systems and mainframe security, and ineffective maintenance of key application security, that constituted a significant deficiency in IRS's internal control over financial reporting systems. Until IRS fully addresses existing control deficiencies over its financial reporting systems, there is an increased risk that its financial and taxpayer data will remain vulnerable to inappropriate and undetected use, modification, or disclosure.

In addition to its internal control deficiencies, IRS faces significant ongoing financial management challenges associated with (1) safeguarding the large volume of sensitive hard copy taxpayer receipts and related information, (2) its exposure to significant invalid refunds from identity theft, and (3) implementing the tax provisions of the Patient Protection and Affordable Care Act. The difficulties confronting IRS in its efforts to effectively manage each of these challenges are further magnified by the need to do so in an environment of diminished budgetary resources.