GAO Takes IRS to Task on Information Security Control Lapses

Posted by Terri Eyden on 1692 printer friendly

By Frank Byrt

Although the IRS has continued to make progress in addressing information security control weaknesses, the Government Accountability Office (GAO) said in a March 2013 report that "serious weaknesses remain that could affect the confidentiality, integrity, and availability of financial and sensitive taxpayer data."
 
The GAO report, Information Security: IRS Has Improved Controls but Needs to Resolve Weaknesses, is based on its audit of the IRS' fiscal years 2011 and 2012 and assesses the effectiveness of the IRS' key financial and tax-processing systems in ensuring the confidentiality, integrity, and availability of financial and sensitive taxpayer information. The report also reviews the progress the IRS has made toward remedying security problems identified in a previous GAO audit.
 
While the report acknowledges that the IRS has dedicated significant assets toward resolving information security controls weaknesses, there are lingering deficiencies in that area along with new ones identified during the latest audit. "While not collectively considered a material weakness [the deficiencies] are important enough to merit the attention of those charged with governance of IRS."
 
An underlying reason for these weaknesses is that the IRS has not effectively implemented portions of its own information security program, the report said.
 
Among the issues cited by the GAO as needing attention are identifying and authenticating control weaknesses that provide access to systems and data. The GAO found: 
  • Authentication controls for some databases were not set to prevent certain types of   vulnerabilities.
  • Passwords were stored without adequate controls to prevent them from being disclosed.
  • Controls over the complexity and age of passwords for some databases were not adequate; sometimes there were passwords that could be easily guessed or that had not been changed in nearly two years.
The GAO said the system's vulnerability was compounded by the fact that the unauthorized access would be virtually undetectable since no unusual system activity would be involved if the unauthorized access would be made via a valid username and password. "As a result of these weaknesses, the IRS had reduced ability to control who was accessing its systems and data."
 
The GAO report concluded that "until the IRS appropriately controls users' access to its systems and effectively implements its procedures for authorization, the agency has limited assurance that its information resources are being protected from unauthorized access, alteration, and disclosure."
 
In a March 11, 2013, response letter amended to the GAO report, IRS Acting Commissioner Steven T. Miller wrote, "The IRS continued to make improving security a top priority during fiscal year 2012. We are pleased the Government Accountability Office recognized our progress in strengthening controls over information security resulting in a downgrade of the information security material weaknesses." 
 
He added, "We will review of all of GAO's reported recommendations to ensure that our actions include sustainable fixes that implement appropriate security controls."
 
Related articles:
 
Tags 
GAO
IRS
Cybercrime

Voice of the Editor

Even though any accounting auditor would tell you it seems like there are an awful lot of tax accountants out there, surely one-third of the country isn't made up of tax preparers, so it's rather startling news to learn that one-third of Americans like to do their taxes. Who knew?
Read more
Gail Perry, CPA
Publisher/Editor-in-Chief, AccountingWEB
editor@accountingweb.com
ADVERTISEMENT

This Week on AccountingWEB

Bill Walter of Gross, Mendelsohn & Associates and Harold Gaar of TravisWolff LLP weigh in on mobile technology use while employees are at work.
WestArk RSVP and Fayette County Community Action Agency – organizations that received grant funding through the IRS Tax Counseling for the Elderly (TCE) program – spoke with AccountingWEB about how they assist senior citizens in their communities.
CPA Robert Raiola, who heads the Sports & Entertainment Group of Fazio, Mannuzza, Roche, Tankel, LaPilusa, LLC, talks NFL player income taxes with AccountingWEB.
Retiring KPMG Centennial Professor of Accounting at the University of Texas at Austin McCombs School of Business Robert May, PhD talks with AccountingWEB about his rewarding forty-three-year career.
ADVERTISEMENT
ADVERTISEMENT
ADVERTISEMENT