Statement of James R. White, Director, Tax Issues, U.S. General Accounting Office

Testimony Before the Subcommittee on Oversight
of the House Committee on Ways and Means

Hearing on the 2001 Tax Return Filing Season

April 3, 2001

We are pleased to participate in the Subcommittee’s hearing on the Internal Revenue Service’s (IRS) 2001 tax return filing season.  As requested by the Subcommittee, our testimony deals with three related subjects: (1) the status of the 2001 filing season, (2) the status of IRS’ business systems modernization effort, and (3) the security of IRS’ electronic filing system.  It is fitting to discuss these three topics together.  The only contact most Americans have with IRS comes during the filing season, when they file their returns, call IRS for help, or visit an IRS walk-in site for assistance.  If the promise of IRS’ modernization is to be realized, that is, if taxpayers are to receive better service in future filing seasons, IRS must succeed at modernizing its information systems and ensuring the security of tax data.

Our statement is based on (1) the preliminary results of our review of the 2001 filing season being done at the Subcommittee’s request, (2) past and ongoing reviews of IRS’ systems modernization effort, and (3) information in our recently-issued report on the security of IRS’ electronic filing systems.^[1]

Our testimony makes the following points:

·       Although the 2001 filing season appears to be running smoothly, there are some matters that require further attention.  First, not unexpectedly, IRS’ reorganization has had little effect on taxpayers this year, but several challenges remain if the reorganization is to ultimately improve taxpayer service.  Second, although the percentage of returns filed electronically has increased, the rate of increase is below expectations.  Third, in an effort to make electronic filing truly paperless, IRS now allows electronic filers to “sign” their returns with a Personal Identification Number (PIN).  Although many taxpayers have successfully used a PIN, many others who tried to do so had their returns rejected for reasons that are still not clear.  Fourth, data obtained from IRS indicate that taxpayers are having an easier time reaching IRS to ask questions about the tax law, their accounts, and their refunds; but IRS still has concerns about the productivity of its telephone assistors.  And, fifth, IRS’ walk-in sites are continuing to provide poor tax law assistance this year.  Although IRS has changed the way it is organized and staffed to provide such assistance, it has deferred making changes to improve the quality of that assistance until fiscal year 2002.

·      With respect to business systems modernization, we have long held that IRS needs to establish fundamental modernization management controls before it begins to build and implement modernized systems.  IRS has made important progress in developing and implementing these capabilities, but it is still not where it needs to be.  We are therefore concerned that IRS is allowing its system acquisition projects to get ahead of its capabilities for managing them and ensuring that modernized systems deliver promised value, on time and within budget.  While allowing acquisition and building management controls to proceed concurrently introduces an element of risk when systems acquisition projects are in their early, formative stages, the risk is considerably greater when projects enter their later phases (detailed design and development).  At these later junctures in a project's life cycle, system rework, due to not employing disciplined modernization management controls, is much more expensive and time-consuming than it is earlier.  Given that IRS needs additional money to invest further in modernization, both near‑term and longer term, and is seeking congressional approval of these funding needs, this is an opportune time to ensure that IRS addresses these risks.

·       Our review of IRS’ electronic filing systems last year showed that IRS had ineffective controls to ensure the security of those systems and electronically-transmitted taxpayer data.  We demonstrated that individuals, both inside and outside of IRS, could gain unauthorized access to IRS’ electronic filing systems and view, modify, copy, or delete taxpayer data.  Although IRS said that it had not evidence of any such intrusions, it did not have adequate procedures to detect intrusions if they had occurred.  According to IRS officials, IRS moved promptly to correct the access control weaknesses we identified before this filing season.  It developed plans to improve security over its electronic filing systems and internal networks and said that it had substantially implemented those plans.  Sustaining effective computer controls in today’s dynamic computing environment will require top management attention and support, disciplined processes, and continuing vigilance.

At the Subcommittee's request, we are reviewing IRS' performance during the 2001 filing season.  Our testimony today on the 2001 filing season focuses on four specific areas—the effect of IRS’ recent reorganization on the filing season, IRS’ performance in processing returns and refunds, the ability of taxpayers seeking help to reach IRS by telephone, and the quality of service being provided taxpayers who visit an IRS walk-in site.  Our preliminary analysis shows mixed results; there are several positive aspects of this filing season as well as several concerns.  Specifically,

·       not unexpectedly, given its newness, IRS’ reorganization has had little effect on taxpayers this year; but several challenges remain if the reorganization is to achieve its ultimate goal of improving customer service;

·       IRS has processed income tax returns and refunds without any significant problems and has received a growing percentage of returns electronically; but the rate of growth in electronic filing is less than expected, and many taxpayers encountered problems in trying to file their electronic returns with a PIN;

·       IRS has done a better job of answering the telephone when people call for assistance, but there are continuing concerns about declines in the productivity of telephone assistors that have prevented further improvements in service; and

·       IRS changed the structure and increased the staffing of its field assistance program in an effort to provide better service, but remains concerned about the quality of tax law assistance being provided by its walk-in sites.

Our preliminary analysis is based primarily on data provided by IRS that we did not verify.  However, those data generally came from management information systems that we have used in the past to assess IRS operations.

IRS’ Reorganization Has Had Little Effect on Taxpayers This Year; Several Challenges Remain If the Reorganization Is to Achieve Its Ultimate Goal

This year marks the first filing season since IRS reorganized into four operating divisions based on the type of taxpayer.  The responsibilities of one of those four divisions, the Wage and Investment (W&I) Division, include processing individual income tax returns and assisting taxpayers at walk-in sites and over the telephone.^[2]  Other than some persons having to mail their returns to different service centers than in the past, IRS’ organizational changes appear not to have altered the way individual taxpayers are interacting with IRS this filing season.  For example, taxpayers are calling the same telephone numbers for assistance that they called last year and are generally visiting the same walk-in sites to pick up forms or get help preparing their returns.

We have also seen no evidence that the reorganization itself has led to significant changes in the level of service being provided taxpayers this filing season.  That is not unexpected.  The reorganization provides a focus on taxpayer segments that IRS expects will help it better understand taxpayers’ needs and identify changes to its systems and procedures for meeting those needs.  Because the reorganization has just been completed, IRS generally has not yet identified those changes in its systems and procedures that may better serve taxpayers.  In the long term, IRS must overcome several challenges if it is to realize the full potential of its reorganization, in terms of improved taxpayer service.

Identifying needed changes and determining whether new approaches to serving taxpayers are successful and worth expanding requires real-time, reliable program performance data.  As we will be discussing later, IRS has made and is making several changes to the measures it uses to assess its performance in processing returns and refunds and serving taxpayers.  IRS plans to have most of these new and revised measures in place this fiscal year and collect sufficient information to set targets or goals for the measures in fiscal year 2002.  We support IRS’ efforts to improve its performance measures.  The new and revised measures could provide useful information in helping IRS assess its performance.  Because trend data on the new measures will not be available until 2002, there will be limited ability to compare IRS year-to-year performance.

IRS also has to do a better job of assessing the information it does collect.  As we discuss in a report on IRS’ telephone assistance that we will be issuing to the Subcommittee later this month, although IRS has undertaken efforts to analyze its performance in providing telephone assistance and identify ways to improve that performance, its analyses did not cover all of the key management decisions and other key factors that affect telephone performance.  For example, in studying the productivity of its telephone assistors, IRS considered the average time taken to handle a call but not the time in-between calls. Without such a comprehensive analysis, IRS management lacks information that would be useful when making decisions about how to improve performance.  We recognize that collecting and analyzing performance data is costly.  However, not having timely, reliable, and comprehensive performance data to support management decision making and aid congressional oversight can also be costly.

Having real-time, reliable data to support decision making also requires that IRS successfully modernize its information systems.  We will be discussing IRS’ progress in that regard later.

IRS’ Processing of Returns and Refunds Appears to Be Proceeding Smoothly, But Preliminary Data on Electronic Filing Raises Some Questions

Although there is much analysis still to do, our preliminary review has not identified any significant problem that has adversely affected IRS’ ability to process returns and refunds.  IRS has developed several new or revised measures for assessing its processing performance this year.  However, meaningful performance data related to those measures will not be available for analysis until later in the year, and, as discussed earlier, there will be limited opportunities to compare IRS’ performance with prior years.  One indicator of IRS’ performance that has not been revised is the percentage of individual income tax returns filed electronically.  That indicator shows that the upward trend in electronic filing is continuing although at a slower rate of increase than expected.  IRS has undertaken several initiatives this year to enhance the processing of individual income tax returns.  Although it is too soon to assess the results of those initiatives, there are indications that one initiative—allowing electronic filers to “sign” their returns with a PIN—has encountered some problems.

IRS’ Tax Processing Systems Appear to Be Operating Without Significant Problems

For the first time in several years, the information systems that IRS uses to process returns and remittances are not affected by extensive Year 2000 changes, consolidation of computer operations, or replacement of critical equipment, prompting us to anticipate few problems this year.  That appears to be the case so far this filing season.  Except for some problems associated with IRS’ effort to allow electronic filers to “sign” their returns with a PIN, which we will discuss later, we have seen no evidence that IRS is not processing returns or issuing refunds as quickly as it has in the past. 

Given the volume of tax returns and remittances and the programming changes that IRS makes annually to its systems, some "glitches" are to be expected.  In that regard, IRS experienced minor programming issues during start-up related to notices, and the programming was corrected.  For example, in one case, fewer than 8,000 payment due notices were not mailed timely, which may have resulted in taxpayers being assessed penalties and interest due to no fault of their own.  To remedy the situation, when the notices were mailed, IRS included a statement that said that the notice had been delayed due to technical difficulties and that the payment due date was extended with no impact on the amount due.

IRS Has Developed Several New or Revised Measures for Assessing Its Processing Performance

IRS has developed several new or revised measures for gauging its performance in processing returns, refunds, and remittances.  This is part of an agency-wide effort to develop a system of balanced measures to help IRS achieve its mission of providing America’s taxpayers with top quality service by helping them understand and meet their tax responsibilities and by applying the tax law with integrity and fairness to all.

The new or revised measures are described in table 1.

Table 1:  New or Revised Performance Measures for Returns Processing

One performance measure that IRS revised for the 2001 filing season is “refund timeliness”.  IRS’ goal is to issue a refund on paper returns within 40 days.  Before this year, IRS used the date the taxpayer signed the return as the start date for determining the number of days before it issued the refund.  Under the revised measure, IRS is using the date that IRS received the return.  According to IRS, the way it previously measured timeliness was flawed because the taxpayer could have signed the return several days before mailing it—something that could cause IRS to miss its 40-day goal but over which IRS had no control.  IRS had originally decided to use the postmark date as the starting date for its computation.  However, IRS subsequently determined that it would be labor intensive and costly to use the postmark date—a date that IRS does not currently record for returns received by the filing deadline of April 15.  Instead, IRS decided to use the IRS-received date, which is the date that the document is received at a submission processing center’s loading dock—a date that IRS already records.  Because that date could be several days later than the date the taxpayer signed the return, IRS has, in effect, increased its chances of meeting the 40-day goal.  To maintain something of a level playing field and to better enable IRS to compare this year’s performance with prior years’, it seems that, at a minimum, IRS should have adjusted its 40-day goal downward to approximate the number of days it “saved” by changing the computation start date.

We will continue to monitor IRS' progress in benchmarking its new or revised performance measures and will report the status of IRS' efforts in our final report on the 2001 filing season.

Use of Electronic Filing Continues an Upward Trend, But at a Reduced Rate of Increase

One indicator of IRS’ performance in processing returns that has not changed is the percentage of individual income tax returns that have been filed electronically.  Pursuant to a provision in the IRS Restructuring and Reform Act of 1998, IRS’ goal is to have 80 percent of all returns filed electronically by 2007.  Electronic filing has several advantages for taxpayers and IRS.  For example, IRS acknowledges receipt of an electronic return, electronic filers receive their refunds faster, up-front mathematical checks and other filters in the electronic filing system help to reduce the number of taxpayer errors that IRS has to correct after the return is filed, and returns filed electronically bypass the error-prone manual procedures that IRS uses to process paper returns.

As noted in our report on the 2000 filing season, the number of individual income tax returns filed electronically increased substantially—about 20 percent—in both 1999 and 2000, bringing the total to 35 million returns.^[3]  IRS' projection for this year was 42 million returns—another 20-percent increase.  However, filing data as of March 15, 2001, indicate that IRS may fall short of that projection.

As shown in table 2, about 29.3 million returns had been filed electronically as of March 16, 2001.  Although that is a 10.2-percent increase compared to the same time last year, the rate of increase is considerably lower than last year.  The rate of increase over the last month of the filing season would have to increase substantially for IRS to achieve its projected growth of 20 percent for the year.  Figure 1 shows how the numbers of returns filed overall and electronically have changed over the past 5 years.  Table 2 provides more detailed information on filings for the past 3 years.

Figure 1: Individual Income Tax Returns Received IRS in Total and Electronically

Table 2:  Individual Income Tax Returns Received by IRS

(Number of returns in millions)

^aTraditional electronic filing involves the transmission of returns over communication lines through a third party, such as a tax return preparer or electronic transmitter, to an IRS service center.
^bOn-line returns are prepared and transmitted by the taxpayer through an on-line intermediary using a personal computer and commercial software.
^cUnder TeleFile, certain taxpayers who are eligible to file a Form 1040EZ are allowed to file using a toll-free number on touch–tone telephones.

Source:  IRS’ Management Information System for Top Level Executives.

IRS Has Initiatives Underway to Improve Processing

IRS has several initiatives underway to improve the processing of individual income tax returns.  These initiatives include (1) allowing electronic filers to “sign” their returns with a PIN, thus reducing some of the paper processing associated with electronic filing; (2) validating spouses’ Social Security numbers (SSN), thus ensuring more accurate returns; and (3) enabling taxpayers to authorize IRS to discuss their returns with their paid preparers, thus expediting the resolution of certain issues that arise during processing.  Although it is too soon to assess the affect of these initiatives, there is some information that the PIN initiative, while used by millions of taxpayers, has encountered some problems.

Allowing Electronic Filers to Use a PIN

A major criticism of the electronic filing program over the years has been that it is not entirely paperless.  For example, all electronic filers, except those who filed by telephone (i.e., TeleFile) had to send IRS a signature document.  According to IRS, feedback from the tax practitioner community indicated that making electronic filing paperless would significantly increase taxpayers’ and tax practitioners’ willingness to file electronically.  For the past 3 years, IRS has allowed taxpayers to pay their taxes electronically, thus eliminating the need for taxpayers to send IRS checks and paper vouchers.  But until this year, most electronic filers still had to send IRS a form with their signature.

For the 2001 filing season, IRS instituted the self-select PIN program that makes it possible for taxpayers who file on-line or through a tax practitioner to “sign” their returns electronically and thus file a totally paperless return.  The self-select PIN program, so named because taxpayers select their own 5-digit PIN, replaces the two alternative signature options that IRS tested last year.  The major difference between the self-select PIN program and the alternative signature options tested last year is that virtually all taxpayers filing through a practitioner or on-line this year can file a totally paperless tax return.  Last year only certain taxpayers could do so.  Before IRS will accept an electronic return with a PIN, the taxpayer must include in his or her electronic submission two pre-identified pieces of information from the previous year's tax return.  This information is required to help IRS assure that taxpayers filing with a PIN are who they say they are.  If IRS determines that the information is correct and the submission passes other up-front checks that have been in place for several years, the electronic submission is accepted and the return is considered filed; otherwise the submission is rejected.

As of March 11, 2001, about 5.9 million returns had been filed electronically using the self-select PIN.  Of those 5.9 million returns, about 3.3 million were filed through practitioners and about 2.6 million were filed on-line.  For the same time period last year, about 4.7 million returns were filed using the two alternative signature programs.

One intriguing part of the PIN usage this filing season is that as of March 11, 2001, about 64 percent of the electronic returns filed on-line had a PIN compared to about 16 percent of the returns filed electronically through practitioners.  IRS intends to conduct focus groups with tax practitioners later in the year, and one of the issues to be discussed is what prevented practitioners from using the self-select PIN.  IRS officials said that they believe large tax practitioners are not using the PIN more extensively because many of their customers are first-time clients and neither the customer nor the practitioner has ready access to the necessary data from last year's return.  Without that information, the practitioner may simply file the return electronically with the paper signature document.

According to a representative of the largest tax preparation company, returns filed electronically using self-select PINs have higher reject rates—about twice as high as the reject rates they usually experience on electronic submissions—causing additional burden on the taxpayer and the practitioner. As a result, the company had been advising its clients to use the self-select PIN with caution.  Data obtained from IRS indicated that of about 6.8 million reject conditions identified on electronically filed returns as of March 15, about 1.5 million involved problems related to PINs.^[4] A representative of the National Association of Enrolled Agents told us that one of the problems associated with the self-select PIN program is that many taxpayers and practitioners don’t understand what information is needed to use a PIN.

We will continue to monitor the use of PINs and the issues surrounding that program as we proceed with our assessment of the filing season.  As part of that effort, we will attempt to determine to what extent, if at all, PIN-related problems caused taxpayers to not file electronically.

Validating Secondary SSNs

During its processing of tax returns, IRS validates SSNs on the returns.  If IRS determines that an SSN is invalid, it can disallow the related exemption or deny a claimed earned income credit or child tax credit.^[5]  That, in turn, can change the taxpayer’s tax liability and reduce or eliminate any refund the taxpayer might be expecting.  In past years, IRS has validated primary^[6] and dependent SSNs.  This year, IRS has expanded its SSN validation effort to include secondary SSNs.

Because of a concern that taxpayers are treated fairly in the validation process, the Committee on Government Reform sent a letter to the Commissioner of Internal Revenue in January 2001 requesting information about this initiative.  In his February 2001 response, the Commissioner said that IRS has an extensive, multi-step process to determine the acceptability of a secondary SSN.  If an individual fails to furnish a correct secondary SSN, IRS said it would disallow the exemption but would not alter the joint filing status claimed on the return.

Authorizing IRS to Discuss Returns with Preparers

IRS added a checkbox to the individual income tax forms that are being filed this year that enables taxpayers to authorize IRS to discuss their returns with their paid preparers.  By being able to contact the return preparer directly, IRS believes that it can expedite the resolution of certain issues that arise during processing, such as math errors and missing information on the return, and thus reduce taxpayer burden.  In testimony before the House Government Reform Committee last year, the Commissioner of Internal Revenue estimated that about 2.5 million notices generated from returns processing were related to returns prepared by paid practitioners.

Level of Telephone Service Has Improved, But Declines in Assistor Productivity and Delays in Modernization Prevent Further Improvement

Millions of taxpayers call IRS each year with questions about the tax law, their accounts, and their refunds.  One important indicator of IRS’ performance in assisting these taxpayers is “level-of-service”, which is computed by dividing the number of calls answered by the number of call attempts.  We have adjusted computation of that indicator this year to allow a more accurate comparison with IRS’ performance in past years, although a completely accurate comparison is not possible because data for one of IRS’ phone lines does not show the extent to which taxpayers hung up before being served.  The adjusted indicator shows that IRS has been answering a greater percentage of calls this filing season than it did last year.  However, declines in the productivity of telephone assistors and delays in modernization have prevented even further improvement.  Further improvement is needed if IRS is to achieve its goal of providing telephone assistance comparable to that provided by leading public and private telephone customer service organizations.  In an effort to facilitate that kind of comparison and better gauge its performance in assisting taxpayers, IRS is putting in place some new measures of telephone service.

According to Data From IRS, the Accessibility of IRS’ Telephone Service Has Improved

Taxpayers calling on IRS’ toll-free assistance lines can obtain needed information by talking to an assistor or by using an automated “interactive application.”  However, unlike last year, taxpayers calling on the assistance lines in 2001 are given the option of being routed to another telephone line, the Tele-Tax line, for an automated response to an inquiry about their refund. ^[7] IRS is routing refund inquiry calls to the Tele-Tax line in an effort to improve taxpayer service.  According to IRS, in previous years, these calls would have been answered by a similar automated refund inquiry service on the assistance lines.  Sending these calls to Tele-Tax frees up the assistance lines for calls that require an assistor’s help, making it less likely that taxpayers calling on these lines will get a busy signal.

Because of this change in routing, the level-of-service computation has to be adjusted to properly compare IRS’ performance this year with last year.  As computed in previous years, level of service reflected IRS’ performance on its toll-free assistance lines.  Because refund inquiries were answered by automated systems on the assistance lines in previous years, they were included in computing level of service.  Even though those inquiries are no longer being answered on the assistance lines, they should be included in computing level-of-service for comparability.

Although including the Tele-Tax refund inquiries in the computation of level of service makes the measure more comparable to previous filing seasons, it is not completely comparable because it assumes that all of the callers who were routed to Tele-Tax were actually served.  Unlike data for the assistance phone lines, data for the Tele-Tax line does not allow IRS to determine whether taxpayers hung up before completing an automated service, calls that IRS refers to as “abandoned”.  Calls to the assistance phone lines that are abandoned are not counted as “calls answered” in computing level of service.

While the adjusted level-of-service computation is not completely comparable to previous years, it does indicate that level of service has improved relative to 2000.  Other information from IRS supports this view.  According to IRS data, for example, the level of service through March 10, 2001, for calls routed to assistors was somewhat higher than for a comparable period last year and the number of calls receiving busy signals on the assistance lines during the first 11 weeks of the filing season had declined from about 5.4 million in 2000 to about 3.1 million in 2001.  IRS data also indicate that there have been virtually no busy signals on the Tele-Tax line this filing season.

As shown in figure 2, as of March 17, 2001, IRS’ level of service, including the refund inquiries answered through the Tele-Tax line, was 76 percent—13 percentage points above last year.

Figure 2:  Toll-Free Telephone Level of Service for the First 11 Weeks of the 2001, 2000, 1999, and 1998 Filing Seasons

Table 3 contains more detailed information behind the level of service computations depicted in figure 2.

Table 3:  Toll-Free Telephone Level of Service for the First 11 Weeks of the 2001, 2000, 1999, and 1998 Filing Seasons (in millions)

 

Telephone service	Filing season
	2001a	2000	1999	1998
Call attempts
Excluding refund calls routed to Tele-Tax	18.7	28.4	41.4	29.2
Refund calls routed to Tele-Tax in 2001	11.6
Total call attempts	30.2	28.4	41.4	29.2
Calls answered
Automated	1.6	7.5	6.6	Not available
Assistor	9.7	10.4	13.2	Not available
Refund calls routed to Tele-Tax in 2001	11.6
Total calls answered	22.9	17.9	19.8	21.5
Level of service	76%	63%	48%	74%

Note:  Totals may not compute due to rounding.

 Source:  GAO analysis of IRS data.

Figure 2 and table 3 indicate that the level of service this year is higher than in 1998.  However, because available data for those years are not comparable, we do not know if that is an accurate representation.

Assistor Productivity Decline and Modernization Delays Have Prevented Further Phone Service Improvement

Taxpayer access to telephone assistors is less than it could be because (1) telephone assistor productivity—measured by IRS as how quickly assistors complete telephone calls—has declined for the third filing season in a row and (2) implementation of a modernization project has been delayed.  Increases in assistor productivity could lead to further improvements in telephone service by allowing assistors to answer more calls, thus reducing the extent to which taxpayers receive busy signals or are kept on hold.  Implementation of the modernization project could lead to improved service by freeing up assistors to handle more calls.

As we discuss in a report to be issued to the Subcommittee later this month, the productivity of telephone assistors declined during the 1999 and 2000 filing seasons.  According to IRS officials, although some of the decline in 2000 was caused by assistors handling more of the types of calls that take longer to answer, four policy changes that had the unintended effect of lowering productivity in the 1999 filing season continued to adversely affect productivity in the 2000 filing season.  Specifically, in 1999, IRS (1) discontinued automatically routing another call to an assistor immediately upon completion of a call; (2) increased restrictions on using productivity data when evaluating assistors’ performance; (3) disproportionately diverted staff from peak demand shifts to other shifts when it implemented 24-hour-a-day, 7-day-a-week assistance; and (4) discontinued measuring the productivity of individual call sites.

According to IRS officials, these factors have continued to negatively affect productivity in the 2001 filing season.  The officials said that although some of the decline can be explained by assistors answering more complex calls, assistors clearly are not using their time efficiently.  In that regard, according to IRS, site visits it made earlier this year indicated that assistors who were directly monitored (i.e., someone sitting with them) spent about half as much time wrapping up a call after the taxpayer had hung up than assistors who were remotely monitored.  IRS, in conjunction with the National Treasury Employees’ Union, has taken steps intended to improve productivity.  For example, IRS has conducted a series of training sessions at call sites designed to assist supervisors in ensuring assistors use their time productively, particularly with respect to the time they spend wrapping up calls.  According to IRS officials, data shows that productivity has improved during the year as a result of these efforts.

Delays in implementing a modernization project has also prevented further improvements in telephone service.  IRS’ Customer Communication Project is one of the most important first steps in improving customer service as envisioned in IRS’ modernization plans.  As a key part of IRS’ strategy for improving level of service, Customer Communications enhancements are designed to free-up assistors to handle more calls by routing and answering more calls through automation.  However, one of the enhancements designed to significantly improve level of service will not be implemented until May or June 2001—at least 3 months later than expected and too late to provide the expected benefits this filing season.

Under this enhancement, IRS expected to implement a telephone voice recognition capability in February 2001.  Voice recognition would allow callers with rotary-dial telephones to interact with IRS’ automated routing and answering system in the same way as touch-tone callers do.  Also, voice recognition would require callers with a touch-tone phone to use the automated system even if they do not respond to phone menu prompts to press the appropriate touch-tone key.  According to IRS, a significant number of callers, whether they have rotary-dial telephones or not, do not respond to the prompts; assistors must answer these calls to determine what the taxpayer is calling about and then route the call to the most appropriate source of assistance.  Voice recognition would have allowed IRS to offload some of this workload from live assistors and answer more calls.

IRS is Putting in Place New Performance Measures for Telephone Operations

According to IRS officials, its current level of service measure is not strategically aligned with those used by world‑class customer service organizations, and does not focus efforts at enhancing the customer’s experience or clearly show how human capital and technology investments affect performance.  Therefore, IRS is planning to replace its current level of service measure with two primary measures of service, one for measuring IRS' success at providing taxpayers access to assistors, and another for measuring IRS' success at serving taxpayers though automated services.  Also, IRS intends to gather data on other new measures, including measures of how long taxpayers have to wait to speak to IRS assistors.

We support IRS’ efforts to improve its performance measures, particularly efforts to better gauge how well IRS serves taxpayers and how its performance compares to that of leading private and public telephone customer service organizations. However, unless IRS maintains its current measures while transitioning to its new measures, it will not have comparable data to monitor performance from one year to the next.  We recognize that there is a cost associated with maintaining current measures while developing new measures, and we recognize that doing so may not always be feasible.  However, without comparable historical performance data, IRS will be unable to assess the results of past efforts to improve performance, such as the 1999 policy changes discussed earlier.

IRS changed the way it was organized and staffed to provide face-to-face assistance for the 2001 filing season.  Despite these changes, there are continuing concerns about the quality of tax law assistance being provided.  According to IRS officials, the staffing and training challenges associated with the restructuring made it impractical for IRS to make changes to improve the quality of tax law assistance this fiscal year.  Instead, IRS, with the help of a contractor, is studying how the quality of face-to-face assistance should be measured and improved, with the expectation of making changes for the 2002 filing season.

IRS Has Changed the Way Its Taxpayer Assistance Centers Are Organized and Staffed

Taxpayers can obtain forms, get answers to questions about the tax law and their accounts, and get help in preparing their returns at about 400 Taxpayer Assistance Centers (TAC), which were formerly known as walk-in sites.  Before IRS’ reorganization, the TACs and associated staff reported to 33 district offices.  According to IRS officials, differences in the way TACs were organized and operated within each district caused inconsistencies in the assistance provided to taxpayers.  To provide more consistency in field assistance, the 400 TACs now report to the W&I Division's Field Assistance unit, through a network of 7 area and 34 territory offices.  As of March 17, 2001, according to IRS, the TACs had assisted about 3.4 million taxpayers, compared to about 3.9 million taxpayers as of the same time last year.

According to IRS, it began the year with about 1,000 technical employees in field assistance and had hired another 504 as of March 16, 2001.  Of those 1,504 technical employees, 1,041 are in a new position—taxpayer resolution representative (TRR)—that IRS had established as part of its reorganization.  Persons filing these positions will be required to assume some functions previously done by compliance staff, such as office audits, in addition to their taxpayer assistance duties.

Although IRS is filling the TRR positions primarily from qualified staff in related job series, additional training is required.  According to officials, IRS is surveying the new staff to assess the training gaps and prioritizing the delivery of abbreviated training to fill the gaps.  Not all of the gaps were filled in time for the 2001 filing season.  For example, about 100 staff placed in TRR positions in January 2001, who needed the full 6 weeks of required first-year training, received only 3 weeks of that training.

Considerable hiring and training is also required for new managers in the Field Assistance unit.  Managers of the former walk-in sites were compliance staff who generally moved to the new Small Business and Self Employed Division as part of IRS’ reorganization.  As of December 31, 2000, IRS had filled 29 of the 34 territory manager positions and 154 of the 226 group manager positions authorized.  According to IRS officials, about one-half of the new managers had no field assistance experience and some had no managerial experience.

IRS and TIGTA Reviews Show That TACs Provide Poor Quality Tax Law Assistance

According to W&I field assistance officials, the quality of tax law assistance provided to taxpayers who walk into one of IRS’ TACs this year is about as poor as the quality reflected by IRS' own reviews last year.

IRS employees posing as taxpayers conducted 272 visitations to TACs before the 2000 filing season and another 272 during the filing season.  IRS’ final report on the combined results found, among other things, that although 92 percent of the “assistors spoke to reviewers in a pleasant manner and tone of voice,”

·       81 percent of the reviewers’ questions were not answered correctly; and,

·       21 percent of the reviewers were denied service.

Despite Important Progress, IRS Has Yet to Fully Implement the Capabilities Needed to Effectively Manage the Business Systems Modernization Program

We turn now to business systems modernization (BSM)—IRS’ multiyear program to put in place the technology that will support revamped business processes.  This multi-billion-dollar program, which began a little over 2 years ago and has thus far received congressional approval to obligate about $450 million,^[9] is vital to achieving IRS’ new, customer-focused vision and enabling IRS to meet performance and accountability goals.  BSM consists of a number of new systems acquisition projects that are at differing stages of acquisition and implementation, as well as various program-level initiatives intended to establish the capacity for IRS to effectively manage the projects.

We have long held—and communicated to IRS—the importance of establishing sound management controls to guide its systems acquisition projects; to its credit, IRS has made important progress in this area.  Nevertheless, IRS is starting to let project acquisitions get perilously ahead of controls—proceeding in some cases with detailed systems design and development without having the capacity in place to help ensure that projects perform as intended and are completed on time and within budget.  We remain concerned that at these later stages in systems’ life cycles, the risk of rework due to missing modernization management controls increases, both in terms of probability and impact.  Given that IRS expects to totally exhaust congressionally-approved BSM funding by about November 2001, and thus is seeking additional money for fiscal year 2002, this is a good time to ensure that the overdue modernization management controls are emphasized as a BSM priority.

Figure 3:  Information Technology Management Control Areas Needing Attention

In December 1998, IRS hired a systems integration support contractor to, among other things, help it develop and implement these program capabilities.  Subsequently, the Commissioner adopted a modernization strategy that appropriately required, for example, (1) the use of incremental investment decision making, (2) adherence to a rigorous systems and software life-cycle management method, and (3) development and implementation of an enterprise architecture or modernization blueprint to guide and constrain the content, sequencing, and integration of systems investments.  This approach, however, involved development of these kinds of program-level management capabilities while simultaneously proceeding with project acquisition, in anticipation that program controls would be in place and functioning when these projects reached their later, less formative stages.  Figure 4 illustrates this approach.

Figure 4:  Concurrent Development of Program-Level Controls and Projects

During BSM’s first 18 months, progress in implementing these management controls was slow, while at the same time project acquisitions moved rapidly.  At that time we reported to IRS’ Senate and House appropriations subcommittees that projects were getting ahead of the modernization management capacity that needed to be in place to manage them effectively.  In response to our concerns and the subcommittees’ direction, IRS appropriately pulled back on the projects and gave priority to implementing needed management capacity.

Despite this shaky start to implementing management controls, IRS has since made important progress in its modernization management capacity.  For example, last year we reported that IRS (1) largely defined and implemented its system life-cycle methodology that incorporates software acquisition and investment management processes, (2) defined program roles and responsibilities of IRS and its modernization contractor and began relating with the contractor accordingly, (3) began formally managing modernization risks in an effort to proactively head off problems, and (4) made progress toward producing the first release of its enterprise architecture.^[11]

In addition, we recently reported that IRS had taken steps to address our recommendations aimed at strengthening management of individual BSM projects.^[12]  For instance, it started to manage the Custodial Accounting Project^[13] as an integral part of the modernization program.  On another project, the Security and Technology Infrastructure Release,^[14] IRS assessed security threats and vulnerabilities, analyzed the resulting risk in terms of probable impact, and planned to reevaluate project requirements in light of this risk analysis.  Recently, IRS hired experienced technical and managerial executives and augmented existing modernization staff with experienced IRS information systems personnel.

We are concerned, however, because projects are entering critical stages without certain essential management controls in place and functioning.  In particular, in our ongoing work for IRS’ appropriations subcommittees, we found that IRS is proceeding with building systems—including detailed design and software development work—before it has implemented two key management controls.  First, IRS has yet to develop a sufficiently defined version of its enterprise architecture to effectively guide and constrain acquisition of modernization projects.  Second, it has not yet implemented rigorous, disciplined configuration management practices.  Both of these are requirements of IRS’s own systems life-cycle methodology and are recognized best practices of successful public and private-sector organizations. This increases the risk of cost, schedule, and performance shortfalls.  We have discussed these missing controls with the Commissioner and his BSM executives; they have stated that they plan to have them in place by the end of June 2001. 

Timing is critical.  While the lack of controls can be risky in projects’ early stages, it introduces considerably greater risk when these projects enter design and development.  To mitigate this added risk, IRS needs to fully implement the remaining management controls that we have recommended.  Figure 5 illustrates the growing risk that accompanies project development in its later stages.

Figure 5:  Increased Risk Associated With Inadequate Controls at Later Stages of Project Development

The timing of this hearing is appropriate for ensuring that IRS implements the remaining needed modernization management controls.  While Congress has appropriated about $578 million for this program to date, it also took steps to limit the agency’s ability to obligate funds until certain controls were in place by establishing a multiyear capital account—the Information Technology Investments Account—to fund IRS systems modernization initiatives.  IRS has received about $450 million of this total, and has submitted a plan to Congress to spend the remainder over the next 7 months.  In addition, IRS plans to include $396 million in funding for BSM in its upcoming fiscal year 2002 budget request.  This is, then, an opportune time to ensure that IRS addresses these outstanding risks as a condition of future funding.

IRS Had Ineffective Controls to Ensure the Security of Electronic Filing Systems And Electronically-Transmitted Taxpayer Data

Computer security is an important consideration for any organization that depends on information systems and computer networks to carry out its mission or business.  However, without proper safeguards, systems and networks pose enormous risks that make it easier for individuals and groups with malicious intent to intrude into inadequately protected systems and use such access to obtain sensitive information, commit fraud, disrupt operations, or launch attacks against other computer networks and systems.  And the number of individuals with the skills to accomplish this is increasing; intrusion—or hacking—techniques are readily available and relatively easy to use.

We recently examined the effectiveness of key computer controls designed to ensure the security, privacy, and reliability of IRS’ electronic filing systems and electronically filed taxpayer data during last year’s tax filing season.  Our recent report discusses the computer control weaknesses that we found, along with actions that IRS says that it took to correct these weaknesses before this year’s filing season.^[15]  What we found to date concerning IRS’ electronic filing program can illustrate the challenges that many organizations are facing.

In an attempt to meet the 80-percent electronic filing goal provided for in the IRS Restructuring and Reform Act of 1998, IRS has aggressively marketed the electronic filing program and has authorized private firms and individuals to be electronic filing trading partners.  These partners include electronic return originators, who prepare electronic tax returns for taxpayers, and transmitters, who transmit the electronic portion of a return directly to IRS.  Except for TeleFile taxpayers, who file their returns using the telephone, IRS does not allow individual taxpayers to transmit electronic tax returns directly to the agency; they must use the services of an IRS trading partner.  Figure 6 demonstrates the path that an electronically filed tax return took from the taxpayer to IRS during the time of our review.

Figure 6:  Electronic Filing Journey, 2000 Filing Season

During the 2000 filing season, IRS did not implement adequate computer controls to ensure the security, privacy, and reliability of its electronic filing systems and the electronically-transmitted tax return data that those systems contained.

We demonstrated that individuals, both internal and external to IRS, could gain unauthorized access to IRS’ electronic filing systems and view, modify, copy, or delete taxpayer data.  Our successful access did not require sophisticated techniques.  Last May, for example, we were able to access a key electronic filing system using a common handheld computer.  We could gain such access because IRS at that time had not

·       effectively restricted external access to computers supporting the electronic filing program through effective perimeter defenses;

·       securely configured its electronic filing operating systems, which used several risky and unnecessary services;

·       implemented adequate password management and user account practices (for example, we successfully guessed many passwords and noted user IDs and passwords posted conspicuously on a monitor);

·       sufficiently restricted access to computer files and directories containing tax return and other data (for example, all users had the ability to modify numerous sensitive data and system files, and certain users with no “need to know” had access, contrary to policy); or

·       used encryption to protect tax return data on electronic filing systems (as is required by IRS’ Internal Revenue Manual).

Further, these weaknesses jeopardized the security of sensitive business, financial, and taxpayer data on other critical IRS systems that were connected to electronic filing computers through its servicewide network because IRS personnel turned off (bypassed) network control devices that were intended to provide security between electronic filing systems and other IRS systems.  Although IRS stated that it did not have evidence that such intrusions had actually occurred or that intruders had accessed or modified taxpayer data, it did not have adequate procedures to detect such intrusions if they had occurred.  For example, IRS did not (1) record certain key events in system audit logs, (2) regularly review those logs for unusual or suspicious events or patterns, or (3) deploy software to facilitate the detection and analysis of logged events.  Consequently, IRS did not recognize or record much of the activity associated with our tests.

These serious access control weaknesses existed because IRS had not taken adequate steps during the 2000 filing season to ensure the ongoing security of electronically transmitted tax return data on its electronic filing systems.  For example, IRS had not followed or fully implemented several of its own information security policies and guidelines when it developed and implemented controls over its electronic filing systems.  It decided to implement and operate its electronic filing computers before completing all of the security requirements for certification and accreditation.^[16]  Further, IRS had not fully implemented a continuing program for assessing risk and monitoring the effectiveness of security controls over its electronic filing systems.

According to IRS officials, IRS moved promptly to correct the access control weaknesses we identified before the current filing season.  It developed plans to improve security over its electronic filing systems and internal networks and said that it has substantially implemented those plans.  In his response to our report, the Commissioner said that “electronic filing systems now satisfactorily meet critical federal information security requirements to provide strong controls to protect taxpayer data.”  Sustaining effective computer controls in today’s dynamic computing environment will require top management attention and support, disciplined processes, and continuing vigilance.

Further, taxpayers who filed electronically may not have been aware that transmitters, who actually send the data to IRS and may be unknown to the taxpayers, could have viewed and modified their data and that such data are transmitted to IRS in clear text—human readable form.  This is because IRS decided to (1) not allow taxpayers to file most electronic returns directly to IRS, (2) require taxpayers who elected to file electronically to use the services of third-party transmitters, and (3) not accept electronic tax returns in encrypted form.  In addition, taxpayers may not have been aware that IRS has no assurance of the security of its electronic filing trading partners’ systems.  Other than providing guidance about protecting certain passwords, IRS did not prescribe minimum computer security requirements for transmitters and did not assess or require an independent assessment of the effectiveness of computer controls within the transmitters’ operating environment.

We provided specific technical recommendations to improve access controls over IRS’ electronic filing systems and networks.  We also recommended that IRS complete the certification and accreditation of its electronic filing systems, assess security risks and routinely monitor the effectiveness of security controls over electronic filing systems, improve certain data reliability and integrity controls, and notify taxpayers of the privacy risks of filing electronically.  IRS agreed with our recommendations and said that it implemented most of the improvements, including correcting critical vulnerabilities, before this year’s filing season.  IRS further said that the actions it has taken demonstrate a systematic, risk-based approach to correcting identified weaknesses.  Such an approach will continue to be important in ensuring that corrective actions are effective on a continuing basis and that new risks are promptly identified and addressed.

Mr. Chairman, that concludes our statement.  We would be pleased to respond to any questions that you or other members of the Subcommittee may have at this time.

1.  Information Security:  IRS Electronic Filing Systems (GAO-01-306, Feb. 16, 2001).

2.  The other three operating divisions are: (1) Small Business and Self Employed, serving fully or partially self-employed individuals and businesses with assets of $5 million or less; (2) Large and Mid-Size Business, serving businesses with assets over $5 million; and (3) Tax Exempt and Government Entities, serving pension plans, exempt organizations, and governments.

3.  Tax Administration: Assessment of IRS’ 2000 Tax Filing Season (GAO-01-158, Dec. 22, 2000).

4.  The number of reject conditions cannot be equated to the number of electronic submissions that were rejected because one submission can have more than one reject condition.

5.  IRS considers an SSN invalid if it is missing from the return or if the SSN and associated name on the return do not match data in the Social Security Administration’s records.

6.  On a joint return, the person whose name appears first on the return is considered the primary taxpayer.  The other person is considered the secondary taxpayer.

7.  In addition to automated refund information, Tele-Tax provides recorded information on about 150 tax topics.

8.  Progress in Developing the Customer Communications Project Has Been Made, But Risks to Timely Deployment in 2001 Still Exist, TIGTA, Reference No. 2001-20-055, Mar. 12, 2001.

9.  IRS requested and Congress established a multiyear systems modernization account and funded it with about $578 million via IRS’ fiscal years 1998, 1999, and 2001 appropriation acts.  To date, IRS has received approval from Congress to obligate about $450 million from the account.

10.  Tax Systems Modernization:  Management and Technical Weaknesses Must Be Corrected If Modernization Is to Succeed (GAO/AIMD-95-156, July 26, 1995).

11.  Tax Systems Modernization: Results of Review of IRS’ Third Expenditure Plan (GAO-01-227, Jan. 22, 2001).

12.  See, for example, IRS’ Custodial Accounting Project (GAO-01-444R, Mar. 16, 2001) and GAO-01-227, Jan. 22, 2001.

13.  The Custodial Accounting Project is expected to provide a single data repository of taxpayer accounts and tax payments as well as related tax revenue accounting and reporting capabilities.  IRS also plans for this project to, among other things, automatically reconcile accounts and payments, post updates to IRS’ general ledger, and produce revenue accounting reports.

14.  This project is the common integrated infrastructure to support and enable modernization business systems applications.  As designed, it consists of a combination of custom and commercial off-the-shelf software, hardware, and security solutions, integrated to form the technical foundation upon which modernized business systems applications will operate.

15.  GAO-01-306.

16.  Accreditation is the formal authorization for system operation and is usually supported by certification of the system’s security safeguards, including its management, operational, and technical controls.  Certification is a formal review and test of a system’s security safeguards to determine whether or not they meet security needs and applicable requirements.