1.4.2. Monitoring and Improving Internal Control

(1) Internal controls are a major part of effectively managing an organization. They comprise of the plans, methods and procedures used to meet missions, goals and objectives. Internal controls support performance-based management. Effective systems of internal control provide unmodified assurance that the IRS achieves the following objectives:

1. Effectiveness and efficiency of operations.

2. Reliability of financial reporting.

3. Compliance with applicable laws and regulations.

(2) All employees must be committed to implementing effective and efficient internal controls. The Department of the Treasury (Treasury), TIGTA and the Government Accountability Office (GAO) provide oversight to evaluate whether control strategies that mitigate program and administrative operational risks are implemented.

(3) Internal controls are the responsibility of every employee. Managers are accountable for and have stewardship of all assigned operations within their organization, including program, administrative and financial, such as:

1. Designing and implementing controls providing unmodified assurance that programs are being accomplished as intended.

2. Conducting regular assessments to identify risks to programs, compliance with laws and regulations and reporting accuracy.

3. Implementing remedies to mitigate risk and measuring the results.

(4) It is important to identify problem areas and take appropriate corrective actions before external auditors, such as GAO and TIGTA, issue findings or before problems escalate into serious control weaknesses. On the other hand, there must be an appropriate balance of control in programs and operations. For example, an over-controlled process or program may be costly to implement and interfere with program accomplishment. Similarly, an uncontrolled or under-controlled process or program may allow problems to go unnoticed and assets to be wasted.

(5) Internal controls focus and awareness should be an integral part of all managers’ and employees’ daily activities. By fostering open, honest communications and promoting problem-solving within an organization, managers create an environment where internal controls are acknowledged as tools to achieve goals.

(1) The Budget and Accounting Procedures Act of 1950, requires the head of each federal department and agency establish and maintain adequate systems of management controls:

(2) The Federal Managers’ Financial Act of 1982, (FMFIA) and Office of Management and Budget (OMB) Circular A-123, Management’s Responsibility for Enterprise Risk Management and Internal Control require federal agencies to improve accountability in federal programs and operations.

(3) The CFO Act of 1990, as amended, requires agencies provide audited financial statements made available to the public.

(4) The Federal Financial Management Improvement Act of 1996 (FFMIA) Financial Management Systems and Appendix D to OMB Circular No. A-123 , require financial systems reviews.

(5) The Government Performance and Results Act Modernization Act of 2010 (GPRAMA) requires annual performance plans and reports.

(6) The Reports Consolidation Act of 2000, requires the Annual Assurance Statement to include reliable Performance Measures.

(7) The Federal Information Security Modernization Act of 2014 (FISMA) and OMB Circular, A-130 Managing Information as a Strategic Resource require annual systems performance and security reviews.

(8) The Standards for Internal Control in the Federal Government, (known as the "Green Book”) provide the overall framework for establishing and maintaining as effective internal control system.

(9) Treasury Directive 40-04, provides guidance on appropriate internal control and implementation for internal control statutes, regulations and other requirements.

(10) Inspector General Act 1978, as amended, 5 U.S.C. Appendix 3, grants the Office of the Inspector General (OIG) administrative authority.

(1) This section provides responsibilities for:

1. Commissioner, Deputy Commissioners and CFO

2. Associate CFO for IC

3. Division Commissioners, Chiefs, National Taxpayer Advocates and Chief Counsel

4. Managers at all levels

5. IC coordinators

(1) Program reports include:

1. MC ESC briefings

2. Annual Assurance Statement

3. Remediation plans

4. Financial Assurance Control Testing (IRM 1.4.3)

5. IRS Quality Assurance Review Program (IRM 1.4.31)

6. Internal Control Review Program (IRM 1.4.32)

(2) Program effectiveness is determined by:

1. Mission and program objectives are accomplished efficiently and effectively.

2. Reliable information is obtained and used for decision making.

3. Laws and regulations are followed.

4. Financial reporting is reliable.

5. Program and resources are protected from fraud, waste, abuse, mismanagement and misappropriation of funds.

(1) The MC ESC is responsible for:

1. Approving extensions to remediation plans.

2. Providing final internal approval of a material weakness closure or downgrade to a significant deficiency and elimination of a significant deficiency.

(1) The following terms and definitions apply to this program:

1. Annual self-assessment - A manager’s review of the effectiveness of internal controls within their area of responsibility and the involvement of each level of management in certifying the control environment within their area is conducive to identifying risks or deficiencies at all levels.

2. Control deficiency - A situation caused by the design or operation of a control not allowing management or employees, in the normal course of performing their assigned functions, to prevent or detect errors on a timely basis, comply with relevant regulations and operate effective and efficient programs and operations.

3. Corrective action - Action taken to correct identified deficiencies.

4. Internal controls - Processes and procedures put into place by management to help an organization operate efficiently and effectively to achieve its objectives. Internal control is an integral component of an organization’s management that provides unmodified assurance that the internal control objectives are being achieved.

5. Material weakness in Internal Control over Financial Reporting - A deficiency, or combination of deficiencies, such that there is a reasonable possibility that a material misstatement of the entity’s financial statements will not be prevented or detected and corrected on a timely basis.

6. Material Weakness in Internal Control over Operations might include, but is not limited to, conditions that:

1) Impact the operating effectiveness of entity-level controls.
2) Impair fulfillment of essential operations or mission.
3) Deprive the public of needed services.
4) Significantly weaken established safeguards against fraud, waste, loss, unauthorized with use or misappropriation of funds, property, other assets or conflicts of interest.

7. Modified assurance - Informed judgment by the head of an organization that internal controls may not be adequate to address specific problems identified in the assurance memorandum.

8. Unmodified assurance - Informed judgment by the head of an organization, based upon sufficient information, that the internal controls in place adequately protect the resources, ensure accurate reporting and facilitate mission completion.

9. Remediation plan - A plan to achieve FFMIA compliance when an agency's annual review determines the financial management systems cannot prepare the required financial statements and reports in accordance with federal accounting standards, provide reliable and timely financial information for managing operations and/or comply with United States Standard General Ledger (USSGL) requirements.

10. Significant deficiency - A deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness, yet important enough to merit the attention of those charged with governance.

(1) The following acronyms apply to this program:

(1) The following IRMs are the most significant IRMs that affect the IRS’s management controls program:

1. IRM 1.4.3, Financial Assurance Control Testing

2. IRM 1.1.31, Office of the Chief Risk Officer

3. IRM 1.4.31, IRS Quality Assurance Review Program

4. IRM 1.4.32, Internal Control Review Program

(1) The steps to downgrade a material weakness or to close a significant deficiency are:

1. Identify/clarify issues that contribute to the material weakness or significant deficiency.

2. Develop planned actions to address the deficiency.

3. Verify that the planned actions will reduce the risk level as expected and informally meet with auditors to discuss the plan of action.

4. Finalize the action plan.

5. Ensure that actions are completed and results have been achieved.

6. Evaluate the process for continuous monitoring to ensure controls are in place and continue to operate effectively to mitigate continued risk and forward to IC for review.

7. Obtain MC ESC approval of closure/downgrade.

8. Prepare a memorandum (prepared by the business unit and reviewed by IC) from the IRS CFO to the TDCFO requesting concurrence for the closure/downgrade, providing the background and summary of accomplishments and results.

9. Report the material weakness or significant deficiency closure/downgrade in the Assurance Statement.

10. While IRS management determines whether a material weakness or significant deficiency has been resolved for Assurance Statement reporting purposes, the financial statement auditors will make an independent assessment of management’s assertion and report that conclusion in their report.

(1) The annual assurance review process focuses on the adequacy of internal controls within an organization. Managers assess risks (for example, the probability of a negative, unanticipated occurrence) of operations, determine whether controls mitigate those risks and report whether those controls are effective. If managers identify weaknesses in their internal control procedures, they are required to report them to the responsible officials and business unit leadership so that a corrective action plan can be developed and implemented.

(2) Each spring, the CFO issues guidance to the Deputy Commissioners, Division Commissioners, Chiefs, Directors, National Taxpayer Advocate and Chief Counsel on the annual self-assessment of internal controls, known as the Internal Controls Managerial Assessment (ICMA) and on preparing the annual assurance memorandum for their organizations.

(3) All managers use the ICMA to conduct an annual self-assessment of their internal controls. Managers review the effectiveness of controls within their own area of responsibility and verify that adequate management controls are in place and functioning effectively to accomplish organizational goals and protect IRS resources. The involvement of each level of management in assessing the control environment within their areas is necessary in identifying risks at all levels.

(4) Managers should report a problem in the design or operation of an internal control to the next level of management as an internal control deficiency. Heads of business units should determine if any reported internal control weaknesses warrant inclusion in their Statement of Assurance memorandum. The MC ESC will determine if the internal control deficiency rises to the level of a significant deficiency or a material weakness. The IRS reports significant deficiencies and material weaknesses to Treasury.

(5) Heads of business units review the ICMA results of their subordinate managers and prepare a Statement of Assurance memorandum indicating the status of their business unit’s internal controls. Heads of business units also consider external auditor reports, internal studies and assessments and other known factors.

(6) The Statement of Assurance memorandum is a one or two-page document containing a specific statement regarding the level of assurance of the business unit’s internal controls. There are three types of assurance:

1. Unmodified assurance is an informed judgment by the head of an organization, based on all available information, that the internal controls in place adequately protect resources and enable mission completion. Unmodified assurance recognizes that the cost of controls should not exceed the benefits derived from them.

2. Modified assurance is an informed judgment by the head of an organization, based on all available information, that the internal controls in place may not be adequate to address the problems identified in the Statement of Assurance memorandum. One or multiple material weaknesses that may not be pervasive are noted. This level of assurance is based on the seriousness of the problems.

3. Statement of no Assurance indicates that material weaknesses exist and that there is no, or a limited, system of internal control in this organization.

(7) The Statement of Assurance memorandum briefly describes the process used to assess whether adequate internal controls are in place and functioning effectively to accomplish organizational goals and protect IRS resources. Preparers consider the information systems environment operated or used by their organizations and issues identified by GAO, TIGTA and IRS management reviews (if applicable) in preparing the memorandum.

(8) Corrective action plans for newly identified internal control deficiencies should be included with the Statement of Assurance memorandum. Managers execute actions necessary to resolve internal control deficiencies, regardless of whether the MC ESC deems them significant deficiencies or material weaknesses. Corrective action plans for internal control deficiencies identified in the previous fiscal year will be updated.

(9) Internal control deficiencies that have been corrected will be submitted with a certificate of completion describing the validation process and the results indicator data that verifies that the internal control weakness has been corrected.

(10) The MC ESC will review and evaluate these documents and other relevant information to recommend to the Commissioner the level of assurance for submission in the IRS’s Annual Assurance Statement and any newly identified material weaknesses or significant deficiencies.

(11) The Commissioner signs and submits an Annual Assurance Statement to Treasury in early November each year.

(12) The Commissioner also provides an additional management Assurance Statement that is included in the annual IRS Financial Report. This management assurance is provided at the IRS bureau level and is intended to mirror agency requirements for reporting on internal controls over reporting, as described in OMB Circular A-123 and OMB Circular A-136, Financial Reporting Requirements. Like the Commissioner’s Annual Assurance Statement, the Commissioner’s IRS Financial Report management Assurance Statement is signed and submitted in early November of each year.

(1) In fiscal year 2012, the IRS expanded its annual assurance process to identify key program evaluations, managerial, operational, security and quality assurance (“reviews”) conducted by the business units to assess the effectiveness of IRS internal controls. These internal control reviews are important to the IRS and can result in greater efficiency, better taxpayer experiences and more effective responses to issues identified by GAO and TIGTA. See IRM 1.4.31, IRS Quality Assurance Review Program for information on the Quality Assurance Review Program.

(1) IC provides business units with insight into the effectiveness of their implemented corrective actions for audit recommendations issued by GAO and TIGTA and evaluates critical controls over IRS programs identified as high risk, high impact or high visibility. This independent examination is known as an Internal Control Review (ICR) and assists IRS business units when they review and evaluate their internal control processes. See IRMs 1.4.3, Financial Assurance Control Testing and 1.4.32, Internal Control Review Program for additional information on the IC review Program.

(1) Outreach and Reporting (OR) works with external stakeholders to manage and control oversight processes through the MC ESC and the Subgroup.

1. The Improper Payments program provides Servicewide oversight for all improper payments reporting and compliance requirements pursuant to the Payment Integrity Information Act of 2019 (PIIA). The overall goal is to reduce improper payments by fostering an effective internal control framework, while also realizing the statutory implications and limitations of programs within the tax system.

2. The Management’s Discussion and Analysis (MD&A) is prepared each fiscal year as Required Supplemental Information to the IRS Financial Statements and is published annually in the IRS Agency Financial Report. It contains a high-level overview of the IRS’s organizational structure, strategic framework, programmatic and financial performance, as well as management assurances related to the IRS’s internal controls. The MD&A also contains other information required by OMB Circular A-136, Financial Reporting Requirements and Federal Accounting Standards Advisory Board’s Statement of Federal Financial Accounting Standards 15. IRS offices and business units provide information reported in the MD&A in accordance with the current fiscal year’s deliverable timeline.

(2) Outreach and Education section promotes internal control across the IRS by coordinating activities with and among staff throughout the IC organization. The Internal Controls Outreach & Education Program assists IRS business units in following through on organizational commitments, policy objectives, applicable laws, regulations and related processes and procedures. The overall goal is to enhance efficient and effective operations by increasing awareness of internal control through collaboration, communication, education and training.

(1) Managers are responsible for determining what levels of risk they are willing to assume. Assessing risk enables managers to reduce unwanted surprises.

(1) The Office of the Chief Risk Officer oversees Enterprise Risk Management (ERM). The ERM program provides an agency-wide approach to risk management and helps IRS units incorporate risk management principles into strategies and daily operations. See IRM 1.1.31, Organization and Staffing, Office of the Chief Risk Officer for additional information regarding the responsibilities of the Chief Risk Officer.

(1) An effective control environment accomplishes the following:

1. Competent employees understand their responsibilities and the limits of their authority and are knowledgeable and committed to performing tasks correctly.

2. Employees follow the IRS policies and procedures, as well as the IRS ethical standards.

(1) Risk assessments allow the IRS to be aware of any internal and external risks that could affect its ability to meet its goals. Through risk assessments, the IRS can manage risks better by establishing appropriate internal controls to mitigate or minimize risks to acceptable levels.

(2) Risk assessments are iterative processes and should be reviewed and updated when changes occur or new risks emerge.

(1) Management should establish only those control activities necessary to accomplish the IRS mission and objectives effectively and efficiently.

(2) The following chart provides the timing, method and type of controls management can leverage in developing a control.

(1) Management has a critical role in the internal control system. Managers should focus their monitoring activities on high-risk areas.

(2) Management should review tasks or techniques to provide a reasonable level of confidence that controls are functioning as intended.

(3) Management is responsible for governance of testing the design and operating effectiveness of internal controls.

(1) In testing the design of an internal control, management is responsible for validating that the internal controls, if implemented effectively, would address the identified risk.

(2) In testing the effectiveness of internal controls, management is responsible for validating whether the control operated effectively and consistently over a period of time.

(1) The GAO and TIGTA audit and investigate IRS operations to:

1. Promote economy and efficiency.

2. Detect and prevent fraud and abuse.

3. Recommend actions for improvement.

(2) The timely closure of GAO and TIGTA audit recommendations are a positive indicator on the IRS’s control environment.

(1) The Deputy Commissioner for Operations Support and the Deputy Commissioner for Services and Enforcement are co-chairs of the MC ESC. The CFO is the vice-chair. The members are the TDCFO; Commissioner, Small Business/Self Employed; Commissioner, Wage and Investment; Commissioner, Large Business and International; Commissioner, Tax Exempt and Government Entities; Chief Information Officer; Chief Risk Officer; Chief, Facilities Management and Security Services; Chief Privacy Officer and Human Capital Officer.

(2) The CFO chairs the MC ESC Subgroup. The other participants are the Associate CFO for IC and support staff, decision-making executive representatives of the MC ESC voting members and program managers responsible for the topics/issues being discussed by the MC ESC.

(3) The MC ESC oversees management’s design, implementation and operation of the IRS’s internal control system to ensure that internal controls are universally recognized as a shared responsibility and that internal control deficiencies are identified, analyzed and remediated. The MC ESC’s operations are governed by a charter maintained by IC.

(4) The MC ESC’s mission is to ensure that all business units and functions identify, address and correct internal control deficiencies and recognize the importance of their shared responsibility for designing and implementing strong internal controls.

(5) The MC ESC’s objectives are to build a strong relationship between risk management and internal controls and ensure existing and new controls address identified risks effectively; ensure the remediation of existing control weaknesses and prevent new ones from arising; provide an unmodified Statement of Assurance that IRS internal controls are in place and functioning effectively and achieve an unmodified audit opinion on the IRS’s financial statements.

(6) The MC ESC oversees Servicewide progress in closing open financial statement audit recommendations.

(7) The MC ESC also:

1. Oversees processes to identify, remediate and close material weaknesses, significant deficiencies and other internal control issues and authorizes final engagement with GAO on the downgrade or closure of an existing material weakness or significant deficiency.

2. Approves reopened actions and revised due dates for these actions. A reopened action is one that IRS implemented but the financial statement auditor disagrees that the IRS addressed the recommendation.

3. Oversees the work of the Senior Assessment Team and ensures that the IRS meets all control testing requirements including those required by OMB Circular A-123.

4. Ensures that the IRS meets its reporting and certification obligations under the FMFIA, FFMIA, OMB guidelines, Treasury directives and the annual assurance review process.

5. Serves as an alliance between business units and other steering committees to ensure proper engagement and to minimize duplicative efforts in reporting.

6. Approves the closure of “Hold” recommendations as “unimplemented." Business units may request the MC ESC approve a “Hold” recommendation be closed as “unimplemented.” The following conditions should be in place before a Planned Corrective Action (PCA) could be placed in “Hold” status if:

1. The audit finding upon which the recommendation is based is valid.

2. The recommendation is in an area considered mission critical or requires an improvement that management agrees is critical/necessary.

3. There were no resources available at the time the response to the draft report was written.

(8) The office of the Associate CFO for IC identifies MC ESC agenda topics for:

1. Issues, concerns or recommendations related to the financial statement audit.

2. Issues driven by ICR; Quality Assurance Reviews (QAR); Annual Assurance Statement; OMB Circular A-123 transactions testing and results and other topics directed by senior IRS leadership.

(9) The office of the Chief Risk Officer identifies MC ESC agenda topics for:

1. Issues related to open or recently closed audits.

2. Active/open planned corrective actions.

3. GAO and TIGTA priority recommendations.

4. Other audits, including high priority audits or areas of significant risk or concern unless there is a known or potential effect on the financial statement audit or a significant deficiency.