GAO: IRS Information System Security Controls need improvement

Why GAO Did This Study

“This report presents the new deficiencies in information system security controls identified during GAO’s audit of IRS’s fiscal years 2019 and 2018 financial statements based on its fiscal year 2019 testing of controls over certain IRS financial and tax processing systems relevant to internal control over financial reporting. The report also includes the results of GAO’s fiscal year 2019 follow-up on the status of IRS’s corrective actions to address deficiencies in information system security controls and associated recommendations contained in GAO’s prior years’ reports that were open as of September 30, 2018.”

What GAO Found

“During its audit of the Internal Revenue Service’s (IRS) fiscal years 2019 and 2018 financial statements, GAO identified new deficiencies in information system security controls that along with unresolved control deficiencies from prior audits, collectively represent a significant deficiency in the agency’s internal control over financial reporting systems. Specifically, GAO identified 11 new deficiencies in information system security controls over certain IRS financial and tax processing systems that are relevant to internal control over financial reporting. Of the 11 new deficiencies, five were related to access controls, three were related to configuration management, one was related to segregation of duties, and two were related to information security management program controls. In a separately issued LIMITED OFFICIAL USE ONLY report, GAO communicated to IRS management detailed information regarding the 11 new deficiencies in information system security controls and made 18 recommendations to address them.”

“In addition, GAO found that as of September 30, 2019, IRS had completed corrective actions to address deficiencies in information system security controls associated with 13 of the 127 recommendations resulting from GAO’s prior financial audits. GAO closed these recommendations. In the LIMITED OFFICIAL USE ONLY report, GAO communicated to IRS management the status of previously reported recommendations as of September 30, 2019.”

“As a result, IRS has 132 GAO recommendations to address—the 114 remaining open recommendations from GAO’s prior financial audits and the 18 new recommendations GAO made in the LIMITED OFFICIAL USE ONLY report. Until these new and continuing control deficiencies, which collectively represent a significant deficiency, are fully addressed, IRS financial reporting and taxpayer data will remain unnecessarily vulnerable to unauthorized access, modification, or disclosure.”

What GAO Recommends

“In a separately issued LIMITED OFFICIAL USE ONLY report, GAO made 18 recommendations to address 11 new deficiencies in information system security controls related to access controls, configuration management, segregation of duties, and information security management program. In commenting on a draft of the separately issued LIMITED OFFICIAL USE ONLY report, IRS agreed with GAO’s recommendations and stated that it will ensure that its corrective actions include root cause analysis for sustainable fixes. GAO will evaluate the effectiveness of IRS’s efforts to address these deficiencies during its audit of IRS’s fiscal year 2020 financial statements.”

Read the full 13-page report here.

Source: Management Report: Improvements Are Needed to Enhance the Internal Revenue Service’s Information System Security Controls – May 13, 2020. GAO.

0
Tags:

This topic contains 0 replies, has 1 voice, and was last updated by  Jackie Gilbert 1 month, 3 weeks ago.

  • Author
    Posts
  • #97754

    Replies viewable by members only

    0

You must be logged in to reply to this topic.

CONTACT US

Questions?. Send us an email and we'll get back to you, asap.

Sending

©2020 G2Xchange all rights reserved | Community and Member Guidelines | Privacy Policy | About G2Xchange FedCiv

Opportunities. Starting Points.

About our Data

The Vault is a listing of expiring contracts, task orders, etc. within a certain set of parameters, to include:

  • Have an initial total estimated contract value of $10 million or above
  • Federal Civilian Only – DHS, Transportation, Justice, Labor, Interior, Commerce, Energy, State, and Treasury Actions
  • NAICS codes include: 511210, 518210, 519130, 519190, 541511,
    541512, 
    541513, 541519, 541611, 541618,
    541690, 541720, 541990
  • Were modified within the last 12 calendar months
  • The data represented is based on information provided by the government

Who has access? Please note that ALL G2Xchange FedCiv Members will receive access to all basic and much of the advanced data. G2Xchange FedCiv Corporate Members will receive access to ALL Vault content (basic and advanced).

Feedback/Suggestions? Contact us at Vault@G2Xchange.com and let us know what you think. 

G2Xchange FedCiv

Log in with your credentials for G2Xchange FedCiv

Forgot your details?