GAO Says IRS' Internal Controls Could Result in Security Breaches

Neikirk, Mahoney & Smith, an accounting firm based in Louisville, reports that in their most recent audit, the General Accounting Office (GAO) has slammed the Internal Revenue Service, citing ongoing weaknesses in internal controls and management that could result in taxpayer security vulnerabilities.

Citing "serious control deficiencies", the GAO says the corrective actions the IRS has taken have fallen short because of the failure of the IRS to fully address the system enhancements that will be required to fix the problems. System weaknesses cited in the audit include weaknesses in information security, including missing security updates, insufficient monitoring of financial reporting systems and mainframe security, and ineffective maintenance of key application security.

The most frightening aspect of the GAO's report is until the problems are resolved, there is an increased risk that taxpayer data will be vulnerable to "inappropriate and undetected use, modification or disclosure."

From the audit report, the "IRS did not maintain effective internal control over financial
reporting as of September 30, 2014, because of a continuing material weakness in internal control over unpaid tax assessments. GAO’s tests of IRS’s compliance with selected provisions of applicable laws, regulations, contracts, and grant agreements detected no reportable instances of noncompliance in fiscal year
2014.

The material weakness in internal control over unpaid tax assessments was primarily caused by financial system limitations and errors in taxpayer accounts that rendered IRS’s systems unable to readily distinguish between taxes receivable, compliance assessments, and write-offs in order to properly classify these components for financial reporting purposes. These deficiencies necessitated the use of a compensating estimation process to determine the amount of taxes receivable, the most material asset on IRS’s balance sheet.

Through this compensating process, IRS made almost $17 billion in adjustments to the 2014 fiscal year-end gross taxes receivable balance produced by its financial systems. Serious control deficiencies related to unpaid tax assessments are likely to continue to exist until IRS significantly enhances the capabilities of the systems it uses to account for unpaid tax assessments, and improves
controls over the recording of information in taxpayer accounts so that reliable transaction-based balances for taxes receivable can be ultimately recorded in its general ledger system.

However, IRS’s current corrective action plan does not fully address all of the system enhancements needed to accurately classify unpaid tax assessment transactions, and IRS has yet to identify the underlying control deficiencies causing the errors in taxpayer accounts.

During fiscal year 2014, IRS continued to make important progress in addressing deficiencies in internal control over its financial reporting systems. However, GAO identified new and continuing deficiencies in internal control over information security, including missing security updates, insufficient monitoring of financial reporting systems and mainframe security, and ineffective maintenance of key application security, that constituted a significant deficiency in IRS’s
internal control over financial reporting systems.

Until IRS fully addresses existing control deficiencies over its financial reporting systems, there is an
increased risk that its financial and taxpayer data will remain vulnerable to inappropriate and undetected use, modification, or disclosure.

In addition to its internal control deficiencies, IRS faces significant ongoing financial management challenges associated with (1) safeguarding the large volume of sensitive hard copy taxpayer receipts and related information, (2) its exposure to significant invalid refunds from identity theft, and (3) implementing the tax provisions of the Patient Protection and Affordable Care Act. The difficulties confronting IRS in its efforts to effectively manage each of these challenges are further magnified by the need to do so in an environment of diminished budgetary resources.

Read the full audit report here. http://www.gao.gov/assets/670/666863.pdf

Comment period on private company reporting draws to a close

BY KEN TYSIAC

JANUARY 12, 2012

A comment period on private company financial statements that already has produced more than 6,500 letters has left the Financial Accounting Foundation (FAF) trustees with a lot to consider, FAF President and CEO Terri Polley said Thursday.
Speaking at a North Carolina Association of CPAs meeting that was simulcast on the Web, Polley said the input has been helpful. The deadline is Saturday for comment letters on a FAF proposal that has been strongly contested by the AICPA because it would continue to give FASB the final decision on any modifications to U.S. GAAP for private companies.
FAF’s Oct. 4 proposal called for the creation of a Private Company Standards Improvement Council (PCSIC) to recommend changes to U.S. GAAP for private companies. Those recommendations would be subject to FASB approval.
Polley said the FAF trustees believe it’s important to have a single GAAP and keep standard setting under one organization. The AICPA believes an independent board under FAF’s supervision is the best mechanism for accommodating the needs of private companies that struggle with certain complexities and costs of U.S. GAAP that many deem unnecessary for nonpublic entities.
“I would definitely envision that there will be some changes from what the trustees have proposed,” Polley said in an interview after Thursday’s speech. “How substantive they will be, that remains to be seen, and (the trustees) are the ones that are going to have to make that decision.” - see the rest of this article in the Journal of Accountancy