TREASURY INSPECTOR GENERAL FOR TAX ADMINISTRATION

1 TREASURY INSPECTOR GENERAL FOR TAX ADMINISTRATION . Annual Assessment of the IRS's Information Technology Program for Fiscal Year 2021. December 14, 2021. Report Number: 2022-20-005. This report has cleared the TREASURY INSPECTOR GENERAL for Tax ADMINISTRATION disclosure review process and information determined to be restricted from public release has been redacted from this document. 1. | HIGHLIGHTS: Annual Assessment of the IRS's Information Technology Program for Fiscal Year 2021. Final Audit Report issued on December 14, 2021 Report Number 2022-20-005. Why TIGTA Did This Audit What TIGTA Found This audit was initiated because The IRS continues to make progress in many information technology the IRS Restructuring and Reform program areas. A review of systems security at the Information Act of 1998 requires TIGTA to Sharing and Analysis Center found that the IRS and a contractor annually assess and report on an generally ensured that their actions complied with the law for sharing evaluation of the adequacy and Federal tax information and included privacy controls to protect security of IRS information taxpayer information.

2 Additional reviews found that most sampled technology. Our overall objective laptops and desktops were sanitized prior to disposal, and most was to assess the adequacy and required baseline security controls were implemented for the Get My security of the IRS's information Payment application. technology. The Fiscal Year 2021 IRS Federal Information Security Modernization Impact on Taxpayers Act Evaluation found that three of the five Cybersecurity Framework function areas were rated as effective. However, taxpayer data In Fiscal Year 2021, the IRS. could be vulnerable to inappropriate and undetected use, collected approximately modification, or disclosure until the IRS takes steps to improve its $ trillion in Federal tax security program deficiencies and fully implement all security payments, and processed program components in compliance with the requirements. 269 million tax returns and forms.

3 In addition, Federal tax refund Problems were also reported in the IRS's handling of the privacy of and outlay activities by the IRS taxpayer data, access controls, system environment security, were approximately $ trillion. information system boundary components, network monitoring and This included approximately audit logs, disaster recovery, roles and responsibilities, and $570 billion in Coronavirus separation of duties, as well as security policies, procedures, and Disease 2019 economic impact documentation. payments. Reviews of systems development and information technology The IRS employs approximately operations found that a roadmap was developed to include a 81,600 people in its Washington, framework to identify, classify, and group systems so that potential , Headquarters and encryption solutions could be identified, and that the invoices 501 offices in all 50 States and provided for sampled information technology service contract territories.

4 Payments met minimum Federal Acquisition Regulation standards. Reviews also found that the Chief Information Officer's roles and The IRS relies extensively on responsibilities are defined, and streamlined critical pay authority computerized systems to support activities were compliant with the requirements of the Taxpayer First its financial and mission-related Act of 2019. Finally, the IRS deployed Release 1 of the enterprise operations. Weaknesses within Case Management solution. the IRS's computer operations could begin to adversely affect its However, the Chief Information Officer is not notified of all significant ability to meet its mission of information technology acquisitions. Problems were also reported helping taxpayers comply with with the IRS's information technology acquisitions, asset their tax responsibilities and management, human capital, project management, risk management, enforcing the tax laws with implementation of corrective actions, modernizing operations, and integrity and fairness to all.

5 The Coronavirus Disease 2019 response. What TIGTA Recommended Because this report was an assessment of the adequacy and security of the IRS's information technology based on previous TIGTA and Government Accountability Office reports issued during Fiscal Year 2021, TIGTA did not make any further recommendations. DEPARTMENT OF THE TREASURY . WASHINGTON, 20220. TREASURY INSPECTOR GENERAL . FOR TAX ADMINISTRATION . December 14, 2021. MEMORANDUM FOR: COMMISSIONER OF INTERNAL REVENUE. FROM: Michael E. McKenney Deputy INSPECTOR GENERAL for Audit SUBJECT: Final Audit Report Annual Assessment of the IRS's Information Technology Program for Fiscal Year 2021 (Audit # 202120002). This report presents the results of our assessment of the adequacy and security of the Internal Revenue Service's (IRS) information technology. This review is required by the IRS Restructuring and Reform Act of 1998.

6 1 This audit was included in our Fiscal Year 2021 Annual Audit Plan and addresses the major management and performance challenges of Responding to the COVID-19. [Coronavirus Disease 2019] Pandemic, Enhancing Security of Taxpayer Data and Protection of IRS Resources; Implementing Tax Law Changes, Modernizing IRS Operations, and Improving Tax Reporting and Payment Compliance. Copies of this report are also being sent to the IRS managers affected by the information in the report. If you have any questions, please contact me or Danny R. Verneuille, Assistant INSPECTOR GENERAL for Audit (Security and Information Technology Services). 1. Pub. L. No. 105-206, 112 Stat. 685 (codified as amended in scattered sections of 2 , 5 app., 16 , 19 , 22 , 23 , 26 , 31 , 38 , and 49 ). Annual Assessment of the IRS's Information Technology Program for Fiscal Year 2021. Table of Contents Background.

7 Page 1. Results of Review ..Page 5. Systems Security and Privacy of Taxpayer Data ..Page 6. Systems Development and Information Technology Operations ..Page 40. Appendices Appendix I Detailed Objective, Scope, and Methodology ..Page 73. Appendix II List of TREASURY INSPECTOR GENERAL for Tax ADMINISTRATION and Government Accountability Office Reports Reviewed ..Page 74. Appendix III Glossary of Terms ..Page 76. Appendix IV Abbreviations .. Annual Assessment of the IRS's Information Technology Program for Fiscal Year 2021. Background The Internal Revenue Service (IRS) Restructuring and Reform Act of 1998 1 requires the TREASURY INSPECTOR GENERAL for Tax ADMINISTRATION (TIGTA) to annually assess and report on an evaluation of the adequacy and security of the IRS's information technology. 2 TIGTA's Security and Information Technology Services business unit assesses the information technology of the IRS.

8 By evaluating cybersecurity, systems development, and information technology operations. This report provides our assessment for Fiscal Year 2021. The IRS collects taxes, processes tax returns, and enforces Federal tax laws. In Fiscal Year 2021, the IRS The IRS collected approximately collected approximately $ trillion in Federal tax $ trillion in Federal tax payments payments, and processed 269 million tax returns and and paid approximately $ trillion forms. In addition, Federal tax refund and outlay in refund and outlay activities. activities by the IRS were approximately $ trillion. 3. This included approximately $570 billion in Coronavirus Disease 2019 (COVID-19) economic impact payments paid under the Coronavirus Aid, Relief, and Economic Security Act (CARES Act); 4 the Coronavirus Response and Relief Supplemental Appropriations Act of 2021; 5 and the American Rescue Plan Act of 2021, 6 which included provisions to help stimulate the economy.

9 Further, the size and complexity of the IRS add unique operational challenges. The IRS employs approximately 81,600 people in its Washington, , Headquarters and 501 offices in all 50 States and territories. The IRS relies extensively on computerized systems to support its operations in collecting taxes, processing tax returns, and enforcing Federal tax laws. As such, it is critical that its computer systems are effectively secured to protect sensitive financial and taxpayer data and are operating as intended. In addition, successful modernization of IRS. systems, as well as the development and implementation of new technologies, is necessary to meet evolving business needs and to enhance the taxpayer experience. In Fiscal Year 2021, the IRS's appropriations increased by $409 million to $ billion, designated for taxpayer services, enforcement, operations support, and modernization.

10 The Information Technology (IT) organization comprises a significant portion of the IRS's budget and plays a critical role to enable the IRS to carry out its mission and responsibilities. The IRS's Fiscal Year 2021 projected available funds included approximately $ billion for information technology investments, of which $ billion was received to fund recent legislative 1. Pub. L. No. 105-206, 112 Stat. 685. 2. See Appendix III for a glossary of terms. 3. Federal tax refund and outlay activities include refunds of tax overpayments, payments for interest, and disbursements for refundable tax credits such as the Earned Income Tax Credit and the Additional Child Tax Credit. 4. Pub. L. No. 116-136, 134 Stat. 281. 5. Pub. L. No. 116-260. 6. Pub. L. No. 117-2. Page 1. Annual Assessment of the IRS's Information Technology Program for Fiscal Year 2021. requirements. 7 Figure 1 illustrates the IRS's Fiscal Year 2021 information technology projected available funding by IT organization function and major program.