Audit report: IRS must set deadline for SSN fixes