1
Additional Actions Are Needed to Improve and Secure
the Income Verification Express Service Program
March 8, 2023
Report Number: 2023-45-014
TIGTACommunicat[email protected] | www.treasury.gov/tigta
TREASURY INSPECTOR GENERAL FOR TAX ADMINISTRATION
HIGHLIGHTS: Additional Actions Are Needed to Improve and
Secure the Income Verification Express Service Program
Final Audit Report issued on March 8, 2023 Report Number 2023-45-014
Why TIGTA Did This
Audit
This audit was initiated to
follow up on prior audit
recommendations, assess
the adequacy of Income
Verification Express Services
(IVES) modernization
efforts, and assess
compliance with Taxpayer
First Act provisions that
require the IRS to develop
an online system to process
IVES transcript requests.
Impact on Tax
Administration
Once accepted into the
IVES Program, participants
such as banks and financial
institutions can submit
requests, on behalf of their
clients, to obtain tax
transcripts for individuals
and businesses. To
mitigate the risk of
releasing taxpayers’
information to
unauthorized individuals,
the IRS must authenticate
the validity of the tax
transcript request forms to
ensure that the taxpayers
signed the forms. In
Fiscal Year 2022, the IRS
processed 8.3 million tax
transcript request forms.
What TIGTA Found
IRS management took actions to address our concerns during this review
and addressed recommendations from our prior audit. However, the IRS did
not meet a key requirement of Section 2201 of the Taxpayer First Act.
Specifically, the IRS did not have the capability to process business transcript
requests by January 2023. Despite the Taxpayer First Act requiring the IRS
create a new online system to process transcript requests, IRS management
has not yet made a decision to require participants to use the new system.
Until the modernized IVES system becomes mandatory to use, enhanced
controls will be needed for electronically faxed transcript requests to ensure
that transcripts are not issued to unauthorized individuals.
In addition, TIGTA found that insufficient information is being provided to
both participants and taxpayers. For example, participants will receive
limited reject information and taxpayers will not be notified of a pending
transcript request that requires they log in to their online account to review
and authorize the request.
TIGTA also found that no single point of contact was responsible for
resolving outages of the new inventory management system, thus
contributing to significant processing delays. For example, instead of
processing transcript requests within the IRS’s goal of 72 hours (or
three days), at its peak, transcripts took 502 hours (or over 22 days) to be
processed.
Finally, the IRS continues to process transcript requests even though
taxpayers have an identity theft marker on their account. TIGTA identified
7,619 tax transcripts that the IVES Program improperly issued to the
participants for 6,012 taxpayers for Processing Year 2021. This occurred
because the IRS’s internal guidance has not ensured that its employees were
following the guidelines for rejecting these requests. As a result, there is a
risk of unauthorized disclosure of taxpayer information to unscrupulous
individuals.
What TIGTA Recommended
TIGTA made 14 recommendations to modernize and improve the IVES
Program. This included alerts issued to IRS management during the review
to address concerns such as ensuring the development of business
transcript capability for the modernized IVES system. TIGTA also made
recommendations to implement controls that will adequately authenticate
all transcript requests received via electronic fax and assign responsibility for
addressing and resolving future outages relating to the new inventory
management system.
IRS management agreed with 11 of the 14 recommendations and partially
agreed to one recommendation to provide notices to taxpayers whose
transcript requests were rejected, but chose not to provide notices to
participants citing an increased risk of fraud. Management disagreed with
two recommendations that would enhance controls over electronically faxed
transcript requests and allow taxpayers the opportunity to identify potential
unauthorized access of their tax return data.
U.S. DEPARTMENT OF THE TREASURY
WASHINGTON, D.C. 20024
TREASURY INSPECTOR GENERAL
FOR TAX ADMINISTRATION
March 8, 2023
MEMORANDUM FOR: ACTING COMMISSIONER OF INTERNAL REVENUE
FROM: Heather M. Hill
Deputy Inspector General for Audit
SUBJECT: Final Audit Report – Additional Actions Are Needed to Improve and
Secure the Income Verification Express Service Program
(Audit # 202240510)
This report presents the results of our review to follow up on prior audit recommendations,
assess the adequacy of Income Verification Express Services (IVES) modernization efforts, and
assess compliance with Taxpayer First Act provisions.
1
This review was part of our Fiscal
Year 2022 Annual Audit Plan and addresses the major management and performance challenge
of
Enhancing Security of Taxpayer Data
and
Protection of IRS (Internal Revenue Service)
Resources
.
Management’s complete response to the draft report is included as Appendix III. If you have
any questions, please contact me or Diana Tengesdal, Acting Assistant Inspector General for
Audit (Returns Processing and Account Services).
1
Public Law No. 116-025, 133 Stat. 981.
Additional Actions Are Needed to Improve and
Secure the Income Verification Express Service Program
Table of Contents
Background .....................................................................................................................................Page 1
Results of Review .......................................................................................................................Page 5
Management Took Actions to Address Concerns Reported in
This and Our Prior Review ................................................................................................Page 5
Recommendations 1 Through 3: .............................................Page 5
Recommendations 4 Through 6: .............................................Page 6
Not All Legislatively Mandated Requirements Relating to
the Income Verification Express Service Were Met .................................................Page 7
Recommendation 7: ...................................................................Page 8
Management Is Not Requiring Participants to Use the
Newly Developed System .................................................................................................Page 9
Recommendations 8 and 9: .....................................................Page 10
Recommendation 10: ....................................................................... Page 11
Additional Notifications to Participants and Taxpayers
Would Help Improve Transcript Request Processing .............................................Page 11
Recommendation 11: ................................................................Page 12
No Single Point of Contact Was Responsible for Resolving
Outages of the New Inventory Management System, Thus
Contributing to Significant Processing Delays ..........................................................Page 12
Recommendation 12: ................................................................Page 15
Additional Actions Are Needed to Enhance the Security
of and Improve the Income Verification Express Service
Program ...................................................................................................................................Page 15
Recommendations 13 and 14: .................................................Page 16
Appendices
Appendix I – Detailed Objectives, Scope, and Methodology ..............................Page 17
Appendix II – Outcome Measures .................................................................................Page 19
Appendix III – Management’s Response to the Draft Report .............................Page. 20
Appendix IV - Glossary of Terms ....................................................................................Page. 30
Appendix V – Abbreviations.............................................................................................Page. 31
Page 1
Additional Actions Are Needed to Improve and
Secure the Income Verification Express Service Program
Background
The Income Verification Express Service (IVES) is an Internal Revenue Service (IRS) program
created in Calendar Year (CY) 2006 to provide tax transcripts to a third party (
i.e.
, IVES
participant) with consent of the taxpayer. Tax transcripts can include return information,
account information, and wage and income information. The tax transcripts are often used by
third parties (
e.g.,
clients of IVES participants, such as banks) to process mortgages,
etc
. The
IVES Program is operated by the IRS’s Submission Processing organization and has employees
located in all three Tax Processing Centers: Kansas City, Missouri; Austin, Texas; and
Ogden, Utah.
IVES participant registration
Each company participating in the IVES Program must apply on Form 13803,
Application to
Participate in the Income Verification Express Service (IVES) Program
. The applications are
processed by IVES analysts in the IVES Headquarters office. Figure 1 provides a high-level
overview of the IVES participant (hereafter referred to as “participants”) application process.
Figure 1: Overview of the IVES Participant Application Process
Source: Treasury Inspector General for Tax Administration (TIGTA) graphic summarizing the IVES
participant application process based on review of internal procedures. Note: Step 9 can happen at
any time during the application process.
Page 2
Additional Actions Are Needed to Improve and
Secure the Income Verification Express Service Program
Transcript request processing
To request transcripts from the IRS, participants electronically fax (e-Fax) Form 4506-C,
IVES
Request for Transcript of Tax Return
, with an approved IVES cover sheet, which includes
participant information. IVES participants are charged a user fee by the IRS for each transcript
request submitted. Participants are billed monthly for the prior month’s transcript requests.
Figure 2 provides an overview of the original transcript request process.
Figure 2: Overview of Original Transcript Request Process
Source: TIGTA graphic summarizing the IVES transcript request process after discussions with
IRS management.
Note: TDS = Transcript Delivery System.
1
As of November 3, 2022, there were 669 approved participants of the IVES Program.
During Fiscal Year (FY) 2022, the IRS processed 8.3 million transcript requests. Figure 3 shows
the number of transcript requests processed from FYs 2020 to 2022.
Figure 3: IVES Transcript Request Volumes
and User Fees Collected FYs 2020 Through 2022
FY Transcript Requests
User Fees
2
2020 12.4 million $44.6 million
2021 15.4 million $78.3 million
2022 8.3 million $27.7 million
Source: IRS Chief Financial Officer, Financial Management Office.
1
See Appendix IV for a glossary of terms.
2
The normal user fee is $2 per transcript request. The IRS increased the user fee to $5 per qualified request from
March 2020 to November 2021 to pay for IVES updates required by the
Taxpayer First Act
(Public Law No. 116-025,
133 Stat. 981). Although the increased user fee ended in November 2021, billing is delayed by one month, so fees
were collected through December 2021. For FYs 2020, 2021, and 2022, this includes $16.9 million, $46.2 million, and
$8.1 million, respectively, which were collected for the development of the modernized IVES system.
Page 3
Additional Actions Are Needed to Improve and
Secure the Income Verification Express Service Program
Modernization of the Transcript Request Process
Taxpayer First Act (TFA) requirements
3
The TFA was signed into law July 1, 2019. Section 2201 of the TFA required the IRS to
modernize the IVES Program by January 1, 2023. The IRS is required to develop a system to
receive third-party income verification forms (
i.e.
, transcript request forms) that is fully
automated and accomplished through the Internet in as close to real-time as is practicable and
complies with applicable security standards and guidelines. In addition, all costs related to
implementing the modernized program were to be covered by the increased participant user
fee. These costs include any necessary infrastructure or technology.
In response, the IRS developed a new system that changes the basic structure of how IVES
transcript requests are submitted. With the new system, participants will be allowed to
electronically submit an unsigned transcript request form to the IRS. Participants will have
two options for submitting the unsigned transcript request, a web-based submission or an
application-to-application submission.
4
• Web-based. Web-based submissions are requests submitted through a web-based form
in which the participant provides the information contained within the Form 4506-C.
Web-based submissions are intended for lower volume participants.
• A
pplication-to-application. Application-to-application submissions are requests
submitted directly from a participant to an IRS system via an information technology
application. Application-to-application submissions are intended for higher volume
participants.
After the participant submits the transcript request, the taxpayer will then log in to their online
account to authenticate themselves and electronically sign (e-sign) the form. Figure 4 provides
a basic overview of the new process, created in response to the TFA.
3
Public Law No. 116-025, 133 Stat. 981.
4
Participants will also have an option to submit through the original transcript request process via e-Fax.
Page 4
Additional Actions Are Needed to Improve and
Secure the Income Verification Express Service Program
Figure 4: Overview of the New TFA IVES System
Source: TIGTA graphic summarizing the new IVES transcript request process after discussions with IRS
management.
According to IRS management, the IRS had no plans to mandate the use of the new TFA IVES
system and continued to allow participants to use the legacy IVES system in January 2023.
Shared network folders
In May 2020, the IVES Program created shared network folders at each Tax Processing Center to
store site-specific inventory in response to the Coronavirus Disease 2019 pandemic. This
allowed the IRS to systemically load faxed transcripts directly into the site-specific network
folder instead of manually printing the transcript requests to be worked by IRS employees. The
use of the shared network folders also allowed IVES employees to process transcript requests
while teleworking when the Tax Processing Centers were closed.
Enterprise File Storage (EFS)
The IRS hired a contractor in September 2020 to enhance the shared network folder process and
develop a single nationwide inventory management system, called the EFS. The IRS describes
the EFS not only as a centralized document management system but also one that provides the
capability to process the work electronically, thus eliminating paper. In addition, the EFS was
designated as critical to the filing season. The IRS developed a phased approach to transition
each of the three IVES sites to the EFS beginning with the Ogden Tax Processing Center in
December 2021 and ending with the Austin Tax Processing Center in April 2022.
The EFS was designed to allow better controls over the batching and processing of transcript
requests and provide more consistent transcript processing times. All transcript requests are
consolidated into one inventory, and all three Tax Processing Centers work requests out of a
single inventory.
Page 5
Additional Actions Are Needed to Improve and
Secure the Income Verification Express Service Program
Results of Review
Management Took Actions to Address Concerns Reported in This and Our
Prior Review
During this review, we issued the following detailed e-mail alerts to IRS management outlining
our concerns and are providing the actions taken by IRS management to address these
concerns.
Recommendation 1 (E-Mail Alert): The IVES Program is authorized to have 14 analysts and
one manager to oversee the program. However, for most of CY 2021, there were only
five analysts assigned to support the IVES Program, and one of the analysts was serving as the
temporary manager. On April 22, 2022, we notified the Director, Submission Processing, Wage
and Investment Division, of our concerns with continued staffing shortages. We recommended
that IRS management cancel or permanently reassign the two individuals on long-term details
to other IRS functions and obtain funding to add additional analysts, as needed, for the IVES
Program to be fully and permanently staffed.
Management’s Response: IRS management agreed with our recommendation and as
of August 14, 2022, the IVES Program Office was fully staffed with 15 permanent and
long-term detailed employees.
Recommendation 2 (E-Mail Alert): On February 17, 2022, we notified the Director, Submission
Processing, Wage and Investment Division, of our concerns with participant applications not
being timely processed. IVES Program guidelines require that applications to participate in the
IVES Program be processed by the IVES Headquarters office. However, we found procedures to
process IVES applications were inefficient and undocumented. For example, procedures did not
ensure that the IVES sites were doing preliminary checks of the participant applications to
determine if they were accurately completed (
e.g
., ensuring that a signature was present) and
there were no measurable goals or policies for completing the applications in a timely manner.
5
We recommended that IRS management immediately determine the backlog of participant
applications and develop a plan to address the backlog of applications.
Management’s Response: Management agreed with our recommendation and
assessed the inventory of program applications awaiting processing and assigned the
appropriate resources to resolve it. The applications inventory became current on
May 13, 2022.
Recommendation 3 (E-Mail Alert): On February 17, 2022, we recommended that the Director,
Submission Processing, Wage and Investment Division, develop a plan to centralize the
processing of all participant applications. In the interim, we recommended that management
ensure that IVES coordinators at each site begin performing minimum checks upon receipt of
the application to avoid unnecessary delays in processing.
5
Amended participant applications are submitted for items such as change of address or contact information of the
business that do not require an additional suitability check.
Page 6
Additional Actions Are Needed to Improve and
Secure the Income Verification Express Service Program
Management’s Response: Management agreed with our recommendation and
updated the Internal Revenue Manual (IRM) on May 25, 2022, instructing the IVES
coordinators to conduct initial completeness review checks prior to routing participant
applications to the headquarters staff.
Recommendation 4 (E-Mail Alert): On February 17, 2022, we notified the Director, Submission
Processing, Wage and Investment Division, of our concerns with the lack of metrics/goals for
processing participant applications. We recommended that IRS management update its internal
guidance with this information.
Management’s Response: Management agreed and drafted new IRM procedures for
the 2023 Filing Season, which were published on January 1, 2023.
Recommendation 5 (E-Mail Alert): On April 22, 2022, we notified the Director, Submission
Processing, Wage and Investment Division, of our concerns with a lack of authentication of
taxpayer identity within the IVES Program. IVES analysts are responsible for reviewing
submissions by IVES participants on their continued compliance with IVES Program electronic
signature (e-signature) policies and procedures. IVES analysts review the submission for
sufficiency of the audit and independence of the auditor. We found that reviews of IVES
participant compliance with e-signature policies were largely not conducted. As such, IVES
participants that did not submit their required report did not have their access to the
e-signature program revoked. This increases the risk that IVES participants may be more
noncompliant with IVES Program policies regarding authentication and validation of taxpayer
identity. We recommended that management implement a system for revocation and
notification of participants if an IVES analyst reviews the results of the participant’s independent
audit of their e-signature system and deems the audit results or the system to be insufficient.
Management’s Response: Management agreed and issued the e-signature participants
determination letters summarizing the findings upon completion of the review. The
letters ranged from passing with no errors, passing with minimal errors, warning letters
for defects to be cured, and letters advising of termination from the program.
Additionally, IRM procedures were updated on August 15, 2022, to reinforce that those
requests not submitted by approved e-signature participants are to be rejected.
Recommendation 6 (E-Mail Alert): In March 2022, we notified IRS management of our
concern that information on its website needed to be updated. For example, the forms used to
apply to the IVES Program and submit transcript requests were outdated, the website did not
reflect recent changes that were made to the IVES Program (
e.g.
, the closure of the Fresno Tax
Processing Center), and there was no information related to the compliance requirements for
the IVES Program. We recommended that management review and update public information
on IRS.gov and ensure that information is available to prospective IVES applicants on the
requirements of participants, such as compliance reviews and required e-signature audits.
Management’s Response: Management agreed and updated the IRS.gov landing page
on August 31, 2022, to include IVES program requirements for participants, with the final
publishing of Form 13803.
Page 7
Additional Actions Are Needed to Improve and
Secure the Income Verification Express Service Program
In addition, we are noting the actions management took to address the deficiencies we reported
in our February 2021 report.
6
Specifically, the IRS:
• Completed the participant compliance reviews in July 2022 and took action as
appropriate to remove participants that did not complete the e-signature certification
and submit an annual independent audit report.
• Included a current list of all participants approved to submit e-signed transcript requests
in the EFS in August 2022.
• Implemented procedures in August 2022 to compare e-signed transcript requests
received from participants to a current list of all participants allowed to submit e-signed
requests to prevent the processing of any requests submitted by participants that are
not approved to participate.
• Provided clear guidance on the content that should be included in the annual
independent audit reports submitted by participants. The IRS notified participants of the
requirements in February 2022.
• Updated the cautionary language on the transcript request form to ensure that all fields
are complete prior to the taxpayer’s signature. The IRS updated Form 4506-C in
September 2020 and again in October 2022 to address three of our prior
recommendations.
• Completed suitability assessment checks in July 2022 for the 319 participants that did
not undergo this important check.
Not All Legislatively Mandated Requirements Relating to the Income
Verification Express Service Were Met
The IRS did not ensure that all legislatively mandated requirements of the TFA were met. The
requirement to include all qualified disclosures means the system will be able to process both
individual and business transcript requests. IRS management indicated it planned to deliver the
individual transcript capability by January 1, 2023; however, participants will be unable to
request business transcripts because this capability was not included in the system
requirements. Although Information Technology (IT) organization management indicated that
this capability was delayed due to technical complexities, we found it was delayed due to a lack
of planning by the IT organization. Figure 5 shows the IRS’s compliance with each of the specific
requirements.
6
TIGTA, Report No. 2021-45-017,
Additional Security Processes Are Needed to Prevent Unauthorized Release of Tax
Information Through the Income Verification Express Service Program
(Feb. 2021).
Page 8
Additional Actions Are Needed to Improve and
Secure the Income Verification Express Service Program
Figure 5: Overview of IRS’s Compliance With Section 2201 of the TFA
Section 2201 Requirement IRS Compliance
A system inclusive of all qualified disclosures, implemented no
later than January 1, 2023.
7
Fully automated and accomplished through the Internet in as
close to real-time as is practicable.
Funded via an increased user fee on qualified disclosures solely
for the development of the modernized IVES system.
8
Source: TIGTA’s review of TFA IVES concept solution documents and discussions
with IRS management.
In April 2022, we notified IRS management of our concern about the business transcript request
capability and recommended that the IT organization determine the estimated cost to include
this capability, develop and test this capability, and ensure that participants are aware when
business transcript requests may be submitted through the new TFA IVES system. We also
recommended that the IRS ensure the business transcript request capability was implemented
before the January 2023 legislative deadline.
Management Actions: On July 28, 2022, management provided a cost estimate of $5.7 million
for the business transcript request capability. Management notified the IVES working group in
July 2022 that the business transcript request feature would not be available in January 2023,
and will notify all participants when it becomes available. Finally, management advised that it
estimated that the business transcript capability could be available by July 2023. In the interim,
the IRS will continue to process business transcript requests via e-Fax for at least six months,
until this capability is implemented. For CY 2021, the IRS estimated that business transcript
requests accounted for 30 percent of IVES transcript requests (5.4 million requests).
Recommendation 7: The Chief Information Officer should ensure that the business transcript
request capability is implemented as soon after the January 2023 legislative deadline as
possible.
Management’s Response: Management agreed and will ensure that the business
transcript request capability is implemented by July 2023.
According to the IRS, it met the TFA requirement even though it used discretionary user
fees to fund initial development costs
The initial costs to develop the new IVES system were funded, in part, by other IRS user fees.
Yet, the requirement of the legislation was intended to not use any additional IRS funds to pay
for the updates to the IVES Program. The IRS collected a total of $71.2 million in increased IVES
user fees. As of December 12, 2022, the IRS has spent $63.3 million developing the new IVES
7
IRS management indicated that it planned to deliver individual transcript capability by January 1, 2023.
8
The IRS funded $14 million in initial development costs to develop the new IVES system from other IRS user fees to
achieve a timely start for the program during the period where the increased IVES user fee had not yet been collected.
Page 9
Additional Actions Are Needed to Improve and
Secure the Income Verification Express Service Program
system.
9
According to IRS management, any remaining funds not used to implement this
provision will be returned to the general Treasury fund.
IRS management stated that it used the increased IVES user fees, exclusively for the purpose of
developing the modernized IVES system, once they were collected. However, the updated user
fee amount did not provide sufficient collections to fund the initial development costs. For
example, if the IRS needed to fund development costs of $5 million the first month but only had
collected $2 million the first month, management would have used $3 million in other user fees
to cover the costs as the law does not allow funds to be spent before they are collected. As a
result, the IRS used $14 million in other IRS discretionary user fees to fund initial development
costs; funds that could have been used for other IRS programs had the IRS not delayed
implementing the increased user fee or had it increased the user fee commensurate with the
funding needed. IRS management believes it met the requirements of the TFA by using the
discretionary user fees.
Management Is Not Requiring Participants to Use the Newly Developed
System
As previously noted, the TFA required the IRS to develop a modernized and automated system
for receiving third-party income verification forms. According to information on the IRS’s
website, this new modernized system would replace its current system, which relies on secure
e-faxes. Yet, IRS management has not yet made a decision to require participants to use the
new system. Further, according to industry partners we spoke with, participants have expressed
concerns with the basic functionality of the new system and have warned the IRS that many
participants will refuse to use the new system. Participants prefer the original system in which
the lender obtains the taxpayer’s signature and submits the form on their behalf. Thus, calling
into question the investment made to develop this new system.
Our review of all IVES transcript requests processed between June 2021 and May 2022 further
substantiates this concern. Our analysis shows that only 201,073 (6.6 percent) of 3.1 million
taxpayers who had their transcript requested by the IVES Program had access to an IRS online
account. Online account access is needed in order for the taxpayer to sign their transcript, when
submitted using the new TFA IVES system.
When we brought our concerns to the IRS’s attention, IRS Counsel stated that management can
require participants to use the TFA IVES system. Requiring participants to use the new TFA IVES
system would require fewer employees to manually complete tasks, such as screening of
incoming faxed transcript requests to determine if they were typed or hand written and
manually processing hand written requests. IRS management indicated that they plan to
evaluate participants’ usage levels before making any decisions on whether to mandate the use
of the new TFA IVES system.
9
The IRS funded the initial development of the system with $14 million in discretionary funds and collected
$71.2 million in increased IVES user fees, for a total of $85.2 million. Therefore, $21.9 million remained.
Page 10
Additional Actions Are Needed to Improve and
Secure the Income Verification Express Service Program
Until the modernized IVES system becomes mandatory to use, enhanced controls will be
needed for e-faxed transcript requests
We previously reported concerns with the lack of validation of taxpayer signatures on transcript
requests, noting that this would be resolved by implementing the modernized IVES system. As a
result, we made no further recommendations. However, until the IRS requires participants to
use the new modernized IVES system, participants will be allowed to continue to e-fax transcript
requests. As such, we continue to remain concerned that without proper controls to sufficiently
and adequately validate the transcript request form, there will continue to be a risk of releasing
taxpayers’ information to unauthorized individuals.
When we brought our concerns to management’s attention in April 2022, management stated
that the IRS already has controls requiring IVES employees to review the request for
completeness and research to see if there are identity theft indicators on the taxpayer’s account,
among other checks. IRS management also stated that Internal Revenue Code § 6064 allows for
the IRS to presume the signature is the true signature of the person who signed and that there
is no indication of fraud within the IVES Program. We continue to disagree that the IRS’s
controls for processing faxed transcript requests are sufficient because the IRS has no way of
verifying the signature is the true taxpayer before releasing important tax return information.
IRS management should be proactive in ensuring that additional controls are put into place to
prevent fraudsters from exploiting the IVES Program.
The Commissioner, Wage and Investment Division, should:
Recommendation 8: Complete a usage study and document a decision regarding if the IRS will
mandate that participants use the TFA IVES system.
Management’s Response: Management agreed and will perform a study on IVES
participation and taxpayers’ adoption of the online account access. Management plans
to begin collecting data for the study in January 2024 and will develop a policy decision
by January 15, 2025.
Recommendation 9: Implement controls that will sufficiently and adequately authenticate all
transcript requests received via e-fax. For example, require notarization of a taxpayer’s
signature.
Management’s Response: Management disagreed with the recommendation.
Management indicated that transcript requests do not pose a higher risk than similar
signed submissions of returns, statements, or documents. Current controls fulfill the
requirements for valid consent under Internal Revenue Code § 6103 and adhere to IRS
signature authentication standards.
Office of Audit Comment: Management’s position that transcript requests do
not pose a higher risk than signed submissions of returns, statements, or
documents does not acknowledge the fundamental difference in that a transcript
request authorizes release of sensitive tax information. As we noted, until the
modernized IVES system becomes mandatory to use, we remain concerned that
the IRS does not have adequate controls to validate a taxpayer’s signature and
could be at risk of releasing information to an unauthorized individual.
Page 11
Additional Actions Are Needed to Improve and
Secure the Income Verification Express Service Program
Recommendation 10: Implement processes that would notify taxpayers that a transcript
request form had been processed, giving the taxpayer an opportunity to quickly identify
potential unauthorized access of their tax return data. For example, the IRS could systemically
send a copy of the transcript request form to the last known address of the taxpayer, allowing
the taxpayer to verify their signature.
Management’s Response: Management disagreed with the recommendation.
Management indicated that implementing a secondary confirmation of taxpayer intent
would cause significant delays in responding to time-sensitive requests. The goal is to
process transcript requests within a 65 to 72 hour time frame from receipt. Separate
confirmations could cause taxpayers unnecessary burden because it could delay
mortgage or other application processing that is dependent on transcript information.
Sending an unsolicited communication to the last known address could create an
additional risk of disclosure of taxpayer information.
Office of Audit Comment: We agree that the IRS should not implement a
secondary confirmation from the taxpayer. Our recommendation focuses on
developing a process to notify a taxpayer that a transcript request had been
processed. The notification would allow the taxpayer to contact the IRS if there
was a potentially fraudulent access to their tax return information.
Additional Notifications to Participants and Taxpayers Would Help Improve
Transcript Request Processing
During our discussions with IRS management about the new TFA IVES system, we found that
insufficient information is being provided to both participants and taxpayers. For example,
participants will receive limited reject information and taxpayers will not be notified of a pending
transcript request that requires they log in to their online account to review and authorize the
request. The new IVES system notifies the participant that a transcript has been rejected, but
does not provide information why the request was rejected (
e.g.
,
processing error or the
taxpayer declined to consent to the release of their tax transcript). If participants are not
informed of why their request was rejected, they will continue to submit requests with the same
errors. Thus, potentially burdening the participants and taxpayers and wasting IVES resources in
responding to participant disputes or requests for additional information.
According to IRS management, providing additional information to the participant could
increase the risk of fraudsters learning about validations that the IRS has in place before
releasing transcript information. However, the IVES Program currently provides a reject reason
for participants submitting their transcript requests through e-Fax. Further, IRS management
previously stated there was a low risk of fraud in the IVES Program because participants are
well-vetted and trusted partners. As it relates to not notifying taxpayers of a pending transcript
request, management noted that this is the IVES participant’s responsibility. However,
participants are often third-party intermediaries that do not have direct contact with the
taxpayer. As such, the lack of communication from the IRS may cause unnecessary delays in the
processing of transcript requests.
Page 12
Additional Actions Are Needed to Improve and
Secure the Income Verification Express Service Program
Recommendation 11: The Commissioner, Wage and Investment Division, should assess the
risk of providing additional information to both the participants and taxpayers during the
transcript request process. The IRS should use the risk assessment to update its
communications to the participants and taxpayers through the new IVES system.
Management’s Response: Management partially agreed. The IRS will be sending a
new series of notices to taxpayers whose transcripts were submitted through the new
IVES system, with less detailed explanations of the causes for rejection. Participants who
submitted the transcript requests through the new IVES system will not receive a notice.
Providing additional information to the IVES participants could increase the risk of fraud
against the system.
Office of Audit Comment: Although the IRS’s corrective action will provide an
updated notice to the taxpayer, management did not agree to provide additional
information to the IVES participants. As stated in our report, the IVES Program
currently provides a reject reason for participants submitting their transcript
requests through e-Fax. As such, providing these notifications to participants
who submit transcript requests online should pose no additional risk of
disclosure of taxpayer information.
No Single Point of Contact Was Responsible for Resolving Outages of the New
Inventory Management System, Thus Contributing to Significant Processing
Delays
Our review found that the modernization of the transcript request inventory management
system (
i.e.
, the
EFS) significantly delayed transcript-processing time frames. For example, there
were 72 reported IVES incidents, which resulted in 292 hours of EFS outages between January 8
and September 10, 2022. At its peak, these outages resulted in transcript requests being worked
within 502 hours (over 22 days) as opposed to the IRS’s goal of 65 to 72 hours (three days).
10
These outages occurred because the IRS did not assign responsibility to a single stakeholder to
resolve concerns with outages and identify and address the root cause, even though it classified
this system as mission critical. Figures 6 and 7 illustrate the number of incidents, outage times,
and associated impact on transcript processing time frames during most of Calendar Year 2022.
10
According to the IRS, IVES employees work 22 hours out of a 24-hour period.
Page 13
Additional Actions Are Needed to Improve and
Secure the Income Verification Express Service Program
Figure 6: Overview of EFS Incidents Affecting the IVES
Source: TIGTA analyses of EFS incidents provided by IRS analysts. Note: Outage times are
cumulative for each two-week period.
Figure 7: Overview of IVES Processing Time Frames
Source: TIGTA analysis of IVES inventory information provided by IRS analysts.
The development, maintenance, and trouble shooting of a new inventory management system
requires the coordination of many different IRS functions, both within the IT organization and
the Wage and Investment Division. Figure 8 shows a summary of the multiple stakeholders of
the EFS and their contributions.
Page 14
Additional Actions Are Needed to Improve and
Secure the Income Verification Express Service Program
Figure 8: Stakeholders of EFS Development
Source: TIGTA graphic summarizing stakeholders of the EFS based on discussions with IRS management.
During our discussions with each of these stakeholders, we learned that no single stakeholder
was assigned the responsibility for resolving EFS outages. Each function within the IT
organization explained its responsibilities for either developing the EFS application or the
platform, yet none identified themselves as being solely responsible for resolving outages.
Moreover, the IRS’s Business Technology Operations acknowledged there was a lack of
coordination between IT organization functions, which resulted in time being wasted trying to
figure out who could resolve the outages versus actually resolving the outages. During our
discussions with IRS IT management, they stated that resolving outages was a collaborative
effort across IT functions.
Because the IRS classified the EFS as a critical system for the filing season, the IT organization
needs to ensure that it assigns a single point of contact responsible for addressing and resolving
future outages. This should include providing service that corresponds to its customers’ work
hours.
A root cause analysis of EFS outages took nearly six months to complete
The IRS originally identified the outages as primarily the result of a retransmission error (
i.e.
, the
server fails to acknowledge a transmission and continuously resends the transmission, causing
the network to overload and no longer respond). In response, the IRS opened a “priority one”
ticket on March 24, 2022.
11
The ticket signified the critical nature of the ongoing outages that
were significantly impacting the IVES Program, even though EFS outages predated the opening
of this ticket. The IRS closed the ticket on June 8, 2022; however, outages continued to occur
(albeit with less frequency). In August 2022, we notified IRS management of our concern that a
root cause analysis had not been completed and recommended that management postpone
expanding EFS interfaces or adding workflows until the root cause of EFS outages had been
identified and resolved by the IT organization.
11
The IRS defines a priority one ticket as any issue causing severe, mission-critical work stoppage. The impact may be
on multiple internal or external customers and service to taxpayers. Immediate action is required (
i.e.
, the ticket
should be resolved in four hours).
Page 15
Additional Actions Are Needed to Improve and
Secure the Income Verification Express Service Program
Management action: IRS management agreed and a root cause analysis was performed to
identify and address the reoccurrence of EFS outages. The root cause of EFS stability issues was
identified and provided to the IRS on September 14, 2022, nearly six months after a “priority
one” ticket was submitted.
The EFS will continue to be used in January 2023 to receive business transcript requests and
individual transcript requests in which participants chose not to use the new TFA IVES system.
The IRS also has plans to expand the use of the EFS to other IRS programs during the
2023 Filing Season.
12
A fully functional EFS could greatly benefit these programs by creating
efficiencies through automated inventory management and paperless processing.
Recommendation 12: The Chief Information Officer should assign a single point of contact
responsible for addressing and resolving future EFS outages, including providing service that
corresponds to its customers’ work hours.
Management’s Response: Management agreed with the recommendation and has
identified the User and Network Services function as the single point of contact
responsible for addressing and resolving future EFS outages, including providing service
that corresponds to its customers’ work hours. The User and Network Services function
will initiate and provide adequate direction with key stakeholders to have the EFS added
to the Premium Service List.
Additional Actions Are Needed to Enhance the Security of and Improve the
Income Verification Express Service Program
We previously reported that transcript requests were erroneously processed. The IRS agreed to
ensure that programming was updated and evaluate processes and procedures to ensure that
transcript requests for accounts identified with an identity theft maker were properly rejected.
13
When a taxpayer’s account is identified as having an identity theft marker, guidelines require
that the transcript request for those applicable years should not be processed. Instead, the IVES
Program sends instructions to the taxpayer’s address of record to contact the identity theft
toll-free telephone number.
We identified 7,619 tax transcripts that the IVES Program improperly issued to the participants
for 6,012 taxpayers for Processing Year 2021. This occurred because the IRS’s internal guidance
has not ensured that its employees were following the guidelines for rejecting transcript
requests for taxpayers with identify theft markers. As a result, there is a risk of unauthorized
disclosure of taxpayer information to unscrupulous individuals.
12
Employer Identification Number requests, U.S. Department of Agriculture Certification Forms, U.S. Residency
Certifications, and Return Integrity Compliance Services.
13
TIGTA, Report No. 2021-45-017,
Additional Security Processes Are Needed to Prevent Unauthorized Release of Tax
Information Through the Income Verification Express Service Program
(Feb. 2021).
Page 16
Additional Actions Are Needed to Improve and
Secure the Income Verification Express Service Program
Recommendation 13: The Commissioner, Wage and Investment Division, should develop a
process to ensure that transcript requests for victims of identity theft are not processed
erroneously. These processes should include systemic tools to prevent employees from
processing the requests. In addition, the processes should continually identify and address tax
examiners processing the transcript requests erroneously.
Management’s Response: Management agreed with the recommendation and will
evaluate the feasibility of developing a systemic process to prevent employees from
erroneously processing transcript requests for victims of identity theft.
Management needs to decide whether or not to allow nonlending participants into the
IVES Program
As of July 2022, there were 282 participant applications being held by IVES analysts pending a
policy decision from IRS management regarding allowing additional nonlending participants
(
e.g.
, tax preparation companies, attorneys, and background check companies) into the IVES
Program. Although nonlending participants had previously been admitted to the IVES Program,
IRS management recently cited concerns with admitting large nonlending participants (
e.g.
, tax
preparation companies) due to the expected significant increase in transcript request volumes.
As such, the IVES Program requested a policy decision from IRS management on May 19, 2021.
Many of these 282 applicants have been waiting for a response to their application for over a
year, with no information or communication being given by the IRS.
On June 14, 2022, we notified the Director, Submission Processing, Wage and Investment
Division, of our concerns that applications from nonlending participants have been held for
more than a year pending a policy decision. We recommended that a decision be made so that,
if these participants were allowed, they could begin testing and building their systems to
interact with the new modernized IVES system that became effective in January 2023. As of
September 30, 2022, no decision had been reached.
Recommendation 14: The Commissioner, Wage and Investment Division, should make a
decision within six months on whether or not to allow additional nonlending participants into
the IVES Program.
Management’s Response: Management agreed with the recommendation and will
make a policy decision regarding participation of nonlending participants in the IVES
program by June 2023.
Page 17
Additional Actions Are Needed to Improve and
Secure the Income Verification Express Service Program
Appendix I
Detailed Objectives, Scope, and Methodology
Our overall objective was to follow up on prior audit recommendations, assess the adequacy of
IVES modernization efforts, and assess compliance with TFA provisions. To accomplish our
objectives, we:
• Determined whether the IRS implemented prior TIGTA audit recommendations of the
IVES Program.
• Determined whether modernization or improvements were needed to the IVES
participant application process by reviewing the procedures by which organizations are
admitted to the IVES Program, reviewing public guidance provided to prospective IVES
Program applicants, and assessing IRS policies related to eligibility requirements for the
IVES Program.
• Determined whether improvements or modernization of IVES transcript requests were
needed by reviewing the procedures by which transcript requests are processed as well
as assessing the systemic controls of the new inventory management system.
• Determined whether IVES modernization efforts were in compliance with TFA provisions
by reviewing capabilities of the modernized IVES system as well as assessing the IRS’s
collection and spending of IVES modernization funds.
Performance of This Review
This review was performed at IVES sites located in Kansas City, Missouri; Austin, Texas; and
Ogden, Utah, and with IT organization personnel located in Lanham, Maryland, during the
period February through August 2022. We conducted this performance audit in accordance
with generally accepted government auditing standards. Those standards require that we plan
and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis
for our findings and conclusions based on our audit objective. We believe that the evidence
obtained provides a reasonable basis for our findings and conclusions based on our audit
objective.
Major contributors to the report were Russell P. Martin, Assistant Inspector General for Audit
(Returns Processing and Account Services); Diana M. Tengesdal, Acting Assistant Inspector
General for Audit (Returns Processing and Account Services); Linna K. Hung, Director;
Jeffrey D. Cullum, Audit Manager; Michael F. Shugrue, Lead Auditor; and Ian B. Maloney, Auditor.
Validity and Reliability of Data From Computer-Based Systems
We performed tests to assess the reliability of data extracts received from the Individual Master
File, the Transcript Delivery System, and the Office of Online Services. We evaluated the data by
performing electronic testing of required data elements and reviewing existing information
about the data. In addition, we selected data from each extract and verified that the data in the
extracts were the same as the data captured in the IRS’s Integrated Data Retrieval System. We
determined that the data were sufficiently reliable for purposes of this report.
Page 18
Additional Actions Are Needed to Improve and
Secure the Income Verification Express Service Program
Internal Controls Methodology
Internal controls relate to management’s plans, methods, and procedures used to meet their
mission, goals, and objectives. Internal controls include the processes and procedures for
planning, organizing, directing, and controlling program operations. They include the systems
for measuring, reporting, and monitoring program performance. We determined that the
following internal controls were relevant to our audit objective: the IRS’s policies and
procedures to ensure compliance with the TFA and the IRS process for authentication of
taxpayer signatures on transcript request forms. We evaluated these controls by reviewing the
concept documents for the design of the modernized IVES system, meeting with IRS
management, reviewing the IRM, and reviewing relevant documentation provided by the IRS.
Page 19
Additional Actions Are Needed to Improve and
Secure the Income Verification Express Service Program
Appendix II
Outcome Measures
This appendix presents detailed information on the measurable impact that our recommended
corrective actions will have on tax administration. These benefits will be incorporated into our
Semiannual Report to Congress.
Type and Value of Outcome Measure:
• Taxpayer Privacy and Security – Potential; 2,694,995 business taxpayers will not have the
option for their transcript requests to be processed via the modernized system
(see Recommendation 7).
Methodology Used to Measure the Reported Benefit:
We estimated how many business transcripts would not be processed through the new,
modernized IVES system, which has enhanced authentication controls, from January 2023 to
July 2023. These transcripts did not have the option to be processed via the modernized IVES
system in January 2023, and this will not be available until at least July 2023 (at least six months).
During CY 2021, 17,966,632 transcript requests were processed. The IRS estimates that
30 percent of these transcripts were business transcripts, which is 5,389,990 transcripts. Our
methodology involved the following calculation: 5,389,990 business transcripts from CY 2021 x
0.50 (six months divided by 12 months) = 2,694,995 potential business transcripts for CY 2023
without the option to use a system with adequate authentication controls, putting taxpayer
information at risk of being disclosed improperly.
Type and Value of Outcome Measure:
• Taxpayer Privacy and Security – Potential; 6,012 taxpayers with identity theft markers on
their accounts who had transcripts improperly issued by the IRS in Processing Year 2021
(see Recommendation 13).
Methodology Used to Measure the Reported Benefit:
We analyzed the tax accounts for 3,979,400 individual taxpayers who had IVES transcript
requests processed in Processing Year 2021. We applied the same IRM criteria for rejecting
specific types of transcript requests when certain identity theft markers are present on the
taxpayers’ accounts. Our analysis identified 7,619 transcripts improperly issued for
6,012 taxpayers because the taxpayers’ account had an identity theft marker that should have
prevented issuance of the transcript.
Page 21
Additional Actions Are Needed to Improve and
Secure the Income Verification Express Service Program
Page 22
Additional Actions Are Needed to Improve and
Secure the Income Verification Express Service Program
Page 23
Additional Actions Are Needed to Improve and
Secure the Income Verification Express Service Program
Page 24
Additional Actions Are Needed to Improve and
Secure the Income Verification Express Service Program
Page 25
Additional Actions Are Needed to Improve and
Secure the Income Verification Express Service Program
Page 26
Additional Actions Are Needed to Improve and
Secure the Income Verification Express Service Program
Page 27
Additional Actions Are Needed to Improve and
Secure the Income Verification Express Service Program
Page 28
Additional Actions Are Needed to Improve and
Secure the Income Verification Express Service Program
Page 29
Additional Actions Are Needed to Improve and
Secure the Income Verification Express Service Program
Page 30
Additional Actions Are Needed to Improve and
Secure the Income Verification Express Service Program
Appendix IV
Glossary of Terms
Term Definition
Enterprise Document
Management Platform
A common document management platform to support existing IRS
records management programs, such as the EFS.
Filing Season
The period from January 1 through mid-April when most individual income
tax returns are filed.
Fiscal Year
Any yearly accounting period, regardless of its relationship to a calendar
year. The Federal Government’s fiscal year begins on October 1 and ends
on September 30.
Individual Master File
The IRS database that maintains transactions or records of individual tax
account
Integrated Data Retrieval
System
IRS computer system capable of retrieving or updating stored information.
It works in conjunction with a taxpayer’s account records.
Internal Revenue Manual
The primary, official source of IRS instructions to staff related to the
organization, administration, and operation of the IRS.
IVES Working Group
The IVES working group is comprised of leading companies providing IVES
processing to the lending industry, which includes some IVES participants
and other industry partners.
Office of Online Services
The IRS function responsible for improvements to the tax experience and
consistent enterprise-wide web service options.
Processing Year
The calendar year in which the tax return or document is processed by the
IRS.
Qualified Disclosure
A disclosure made by the IRS to a person seeking to verify the income or
creditworthiness of a taxpayer who is a borrower in the process of a loan
application.
Transcript Delivery System The application used by the IRS to generate tax transcripts.
Page 31
Additional Actions Are Needed to Improve and
Secure the Income Verification Express Service Program
Appendix V
Abbreviations
CY Calendar Year
e-Fax Electronic Fax (Facsimile)
e-Sign Electronically Sign
e-Signature Electronic Signature
EFS Enterprise File Storage
FY Fiscal Year
IRM Internal Revenue Manual
IRS Internal Revenue Service
IT Information Technology
IVES Income Verification Express Service
TFA Taxpayer First Act
TIGTA Treasury Inspector General for Tax Administration
