4.33.1. Managing Electronic Records from Taxpayers and Third Parties

(1) Purpose. This IRM provides procedures for requesting, receiving, preserving, maintaining, storing, controlling, transmitting, and disposing of electronic records received during an examination in accordance with IRM 10.8.1, Policy and Guidance; the IRM 1.15, Records and Information Management, series; and the IRM 10.2. Physical Security Program, series.

(2) Audience. These procedures apply to employees in SB/SE Field Examination and SB/SE Specialty Examination.

(3) Policy Owner. The Director, Examination - Field and Campus Policy, who is under the Director, Headquarters Examination.

(4) Program Owners.

• The Director, Examination - Field and Campus Policy, is responsible for guidance and procedures related to the SB/SE examination process.

• The Records and Information Management (RIM) office, under Privacy, Governmental Liaison and Disclosure (PGLD) is the program office responsible for oversight of the Servicewide records management policy.

• Collection Policy Headquarters, an organization within the Small Business/Self-Employed (SB/SE) division, is the program office responsible for guidance and procedures related to summonses.

• Information Technology (IT) is responsible for delivering IT services and solutions and establishing the security program and the policy framework for the IRS.

(5) Contact Information. To recommend changes or make any other suggestions related to this IRM, see IRM 1.11.6.6, Providing Feedback About an IRM Section - Outside of Clearance.

(1) During the initial conversation, examiners should ask the taxpayer about their use of electronic records, including accounting software. If the taxpayer uses electronic records the examiner should request them early in the examination, as well as user names and passwords necessary to read the electronic files, using Form 4564, Information Document Request (IDR).

(2) If a taxpayer does not voluntarily provide requested electronic records, the examiner should consider issuing a summons to the taxpayer or a third party (e.g., preparer, financial institution) that may have access to the electronic records. To prevent potential defenses the taxpayer may raise if they petition to quash the summons, the language included in the summons should closely resemble the language that was included in the IDR issued to the taxpayer.IRM 25.5, Summons, provides Servicewide summons guidance. See IRM 25.5.2, Preparation, for information related to preparation of summonses and IRM 25.5.3.6, Electronic Summons Process, for more information on the electronic summons process.

(1) Electronic records are received in several ways. Employees should not refuse to accept electronic records, whether they are encrypted or not; however, necessary precautions must be taken to safeguard the data, IRS computers, and the IRS network.

(2) Taxpayers and their representatives provide electronic records by:

1. Email - Employees must advise taxpayers and their representatives that the Service cannot guarantee the security of their information if they choose to send it by email. For guidance regarding transmitting emails with SBU content, see IRM 4.33.1.7.

   Caution: If examiners receive unsolicited emails from taxpayers or their representatives, respond by letter or phone if an address or phone number is available. Examiners should discourage the taxpayer or their representatives from continuing the discussion by email. See IRM 10.5.1.6.8.1(3), Emails to Taxpayers and Representatives.

2. Portable Storage Devices - When electronic records are received on PSDs, employees must follow procedures to protect IRS computers and the IRS network before accessing the records. See IRM 4.33.1.4 for guidance on accessing records stored on PSDs.

(3) Summoned third parties may ask examiners to retrieve records through an electronic summons website. See IRM 25.5.3.6.2, Electronic Retrieval of Records. For additional information, refer to eSummons and Sources that Respond Electronically for approved electronic summons processes.

(1) Examiners must complete the following actions when electronic records are received on a PSD:

1. Follow procedures in IRM 10.8.1.4.10.6(4)(a) through (d), MP-7 Media Use (InTC), regarding virus scans. Document virus scan actions on the Form 9984, Examining Officer’s Activity Record, or RGS/IMS Case History.

   Note: See job aid, How to Run a Virus Scan, for additional guidance on scanning PSDs for viruses.

   Caution: If a virus is detected, do not reconnect the computer to the IRS network and do not power-down or reboot the computer. Within one (1) hour of detection, the examiner must contact their manager and CSIRC. See IRM 10.8.1.4.10.6(4)(d), MP-7 Media Use (InTC), and IRS Computer Security Incident Reporting Procedures.

2. Save the files to an encrypted folder on the examiner’s computer. If it is not possible to immediately save the information to the computer, it must be done at the earliest opportunity.

3. Document all actions taken with electronic records as described in IRM 4.33.1.5.

(2) Examiners must complete the following actions when electronic records are received via email:

1. Save the files to an encrypted folder on the examiner’s computer. If it is not possible to immediately save the information to the computer, it must be done at the earliest opportunity.

2. Document all actions taken with electronic records as described in IRM 4.33.1.5.

(3) Electronic records are generally readable if they are in a format that uses a standard software program (e.g., Word, Excel, Access, Adobe). If the electronic records are not readable, specialists are available to assist with accessing records. For a description of the specialists and how to locate each type of specialist, see the article Who do I contact for assistance?.

(4) Do not open executable files or software applications provided by external parties, including decrypting applications and proprietary applications needed to read data files, as the file may contain a virus that could infect the computer and IRS network. If a file requires the running of an executable file or software in order to access it, see IRM 4.33.1.4.1 (2)(b) and (c) and IRM 25.5.3.5(4), Records on Encrypted Storage Media, for guidance on who to contact for assistance. See also IRM Exhibit 10.8.27-1(9), Prohibited Uses of Government Furnished IT Equipment and Resources, for restrictions related to unauthorized applications or data programs (e.g., executable code).

(1) Examiners must document all actions regarding electronic records on Form 9984, Examining Officer’s Activity Record, or RGS/IMS Case History to document the chain of custody. Documentation must include:

• Date of receipt.

• Name of person who provided the records.

• How the records were obtained (e.g., received on PSD).

• Format of data received (e.g., .docx, .xlsx, .pdf, etc).

• A statement that the original records have not been altered by the examiner.

(2) IRM 1.15.2.2, Definition of Records, describes the statutory definition of a federal record pursuant to 44 U.S.C. § 3301. This definition includes most electronic records received from taxpayers. Federal records, whether electronic or paper, must be retained according to the National Archives and Records Administration (NARA) approved disposition authority or printed and associated with the appropriate recordkeeping system (e.g., case file, RGS, IMS). Unlawfully destroying federal records is a violation of the Federal Records Act and carries stiff penalties. See IRM 1.15.6.9, Retention and Disposition of Electronic Records.

(3) Email messages determined to be federal records are subject to retention policies and can be deleted only when they are eligible for destruction or when they have been printed to paper or PDF and associated with the appropriate recordkeeping system. IRM 1.15.6, Managing Electronic Records, provides guidance regarding the creation, maintenance, use, and disposition of federal records created using IRS electronic information systems and personal computers, including email and other electronic applications. See IRM Exhibit 1.15.6-1, Common Questions about Email, for information on when an email message is considered a federal record.

(4) Instant messaging should not be used to engage in discussions regarding business decisions related to examinations. If instant messaging is used in these situations, the result is a federal record and the message must be saved, printed to paper or PDF, and associated with the appropriate recordkeeping system. See IRM 1.15.6.14.1(3), Use of Agency-approved Electronic Messaging Systems, and IRM 1.15.6.14.2(2)(b) and (c), Preserving Electronic Messages. Also see IRM Exhibit 1.15.6-2, Common Questions about Electronic Messaging, for information on when an instant message is considered a federal record and how to save instant messages.

(5) Electronic records received from a taxpayer, third party, or other stakeholder and copied to an examiner’s computer are considered "original" files. Do not edit the original files. The original files must be maintained in accordance with IRM 4.33.1.6.

(6) Examiners should use original records only to create "working" copies. Once working copies are created, avoid using the original records except to make additional working copies if necessary. The working copies should be used for analysis, documentation, etc. The working copies must be maintained in accordance with IRM 4.33.1.6. Use of a working copy may include, but is not limited to:

1. Sorting and analyzing records using Microsoft Word, Excel, or Access.

2. Opening and reading data files using the related accounting or financial software.

(7) Examiners should record user names and passwords for all PSDs on Lead Sheet 100-1A, External Records Password. The lead sheet must also include a description of the type of data (e.g., summoned records, accounting software files) and the encryption method used (e.g., SecureZip, Symantec Endpoint Encryption Removable Storage [SEERS]). For guidance on creating passwords, see IRM 10.8.1.4.7.4.1, IA-5 Authenticator Management - Control Enhancements.

(8) See IRM 4.33.1.6 for additional information on maintenance and storage of electronic records.

(1) As noted in IRM 4.33.1.5 (5) and (6), the examiner conducting the examination is responsible for maintaining "original" and working copies of electronic records received from taxpayers, representatives, or other parties. Original and working copies can be maintained on the examiner’s hard drive or on an encrypted PSD until they are no longer needed. See IRM 4.33.1.8 for information on when to include electronic files with the closed case file.

(2) Taxpayer data copied and maintained on PSDs must be encrypted using the current IRS IT-approved encryption program (i.e., SecureZip, SEERS) and must be password protected per IRM 10.5.1.6.2.1, External. See IRM 4.33.1.5 (7) for guidance on recording and storing passwords for cases worked in RGS.

(3) Employees must always save Sensitive But Unclassified (SBU) data in the designated encrypted SBU folder of their computer.

(4) To prevent data loss, employees should regularly back up their SBU folder to a government-owned, encrypted PSD.

(1) Electronic data may require transmission to another employee for assistance or conversion from its original format to a readable format (e.g., Excel spreadsheet, PDF, image file). There are several methods that may be used to transmit electronic data.

1. Email - An approved method for IRS-internal transmission only when encryption is utilized. Do not include SBU data (including PII and tax information) in the email subject line. All email messages containing SBU information are required to be sent encrypted per IRM 10.5.1.6.8(6), Email; IRM 10.5.1.6.8.3, Emails to IRS Accounts; and IRM 11.3.1.17.2, Electronic Mail and Secure Messaging.

   Caution: Except as authorized by IRM 10.5.1.6.8.1, Emails to Taxpayers and Representatives, do not send emails to taxpayers or their authorized representatives, even if requested, due to the risk of improper disclosure or exposure per IRM 11.3.1.17.2(7), Electronic Mail and Secure Messaging, and IRM 10.5.1.6.8.1, Emails to Taxpayers and Representatives. For details on email security and encryption, see IRM 10.8.1.4.17.2.2, Electronic Mail (Email) Security.

   Note: Electronic accounting data files may be too large to transmit using encrypted email.

   Note: Large electronic files may need to be transmitted to the Department of Justice (DOJ) if their assistance is needed in certain matters, e.g. summons enforcement. In such cases, contact Counsel to coordinate a transfer of electronic records to DOJ.

2. Instant Message - An approved secure method; however, transmission of large files may take longer over slower internet connections. Although it may be used to transmit electronic data files, do not use instant messaging to engage in discussions regarding business decisions related to examinations. See IRM 1.15.6.14.1(5), Use of Agency-approved Electronic Messaging Systems, and IRM 1.15.6.14.2(2) (b) and (c), Preserving Electronic Messages.

   Note: When transmitting SBU data files, employees should change the default destination folder (i.e., My Received Files) where transmissions are saved to a sub-folder of the encrypted SBU Data folder (if the instant messaging program allows). Alternatively, the default destination folder can be encrypted by right-clicking on the folder and selecting Encrypt.

3. Shipping PSDs - For shipping guidance, see IRM 4.33.1.7.1. One of the alternative methods listed above should be considered in lieu of shipping small PSDs because they can be easily misplaced.

(1) Electronic information that directly supports an adjustment, penalty, or alternative position, whether obtained voluntarily or through summons procedures, must be printed and included in the paper administrative case file. It must also be included in the RGS case file.

(2) Electronic records are often large and include many different file types (e.g., accounting software data files). When determining whether to include electronic records that do not directly support an adjustment, penalty, or alternative position in the case file, a presumption of retention should be used to prevent deletion of any potentially relevant records. This means that an electronic record must be retained unless it is clear that the record will not be relevant to potential future case activities.

(3) Do not include accounting software data files in the RGS case file, as they are not compatible with RGS. See IRM 4.10.9.7.11.1, Electronic Accounting Software Backup Data Files and Spreadsheets, for additional information on closing cases with electronic accounting software data files and spreadsheets.

(4) Retain electronic records in their original format. For example, a document received as a Word file (e.g., docx) must be retained as a Word file. This is necessary to preserve the metadata.

(5) If electronic records require retention, but they are not compatible with RGS, the original records must be copied to an encrypted PSD and the encrypted PSD must be included with the case file. See IRM 4.10.15.7.19, Office Documents and Case File Documents. Working copies must also be copied to an encrypted PSD and placed in the case file if the working copies add merit or value to support audit adjustments. The decision to include or not include the records in the case file is determined on a case-by-case basis.

(6) Any SBU data (including PII and tax information) that may need to be safeguarded from unauthorized disclosure before being provided to the taxpayer in a Freedom of Information Act (FOIA) request must be placed in an "To be Opened by Addressee Only" envelope within the case file. Examples might include an informant referral, information regarding fraud potential, third party tax information, etc. This applies to electronic records as well as paper documents. Disclosure personnel will determine if any of the data can be withheld from release in accordance with disclosure guidelines. See IRM 4.10.9.7.3, Workpapers: Disclosure, and IRM 11.3.13.7, Review and Redacting, for additional information.

(1) After all records have been preserved in conformance with applicable requirements and IRM 4.33.1.8, electronic data files that are no longer needed on the examiner’s computer hard drive must be deleted. See IRM 4.10.15.7.19(6), Office Documents and Case Files Documents, and IRM 4.10.15.10.1(1), Examined Closures (Forms 1040, 1120, 1120S, 1065, and 1040NR), for information on removing files from RGS.

(2) See IRM 4.33.1.8 and IRM 4.10.9.7.11.1, Electronic Accounting Software Backup Data Files and Spreadsheets, for information on what to do when the data needs to be included in the closed case.