<div> WRITTEN TESTIMONY OFJEFFREY J. TRIBIANODEPUTY COMMISIONER FOR OPERATIONS SUPPORTANDEDWARD T. KILLENCHIEF PRIVACY OFFICERINTERNAL REVENUE SERVICEBEFORE THEHOUSE WAYS AND MEANS COMMITTEESUBCOMMITTEE ON OVERSIGHTON IRS RECORDS RETENTION PRACTICES JULY 25, 2017  INTRODUCTION Chairman Buchanan, Ranking Member Lewis, and Members of the Subcommittee, thank you for the opportunity to discuss the IRS’s records management procedures. The IRS has always taken seriously its responsibility to protect official records. Doing so is especially important in order to comply with the Federal Records Act and to respond in a timely manner to document requests from Congress, fulfill court-issued document preservation orders, and answer requests made under the Freedom of Information Act (FOIA). Over the years, the IRS has worked closely with the National Archives and Records Administration (NARA) to improve our processes and protocols in regard to retention of federal records to make sure they are appropriate and work properly. We recently have made significant investments in, and important progress on, a number of fronts to improve our records management practices for email, and to update other existing records management policies, procedures and practices. Our work continues in these areas. At the same time, the IRS has long been challenged in the area of record retention. The capabilities needed to implement new record retention mandates required investments in new technology, but one problem has been that those investment dollars were not available. As a result, some agency practices have not been up to the level of those of a typical modern organization. A case in point is the IRS’s document retention process for electronic records, such as email records, which has involved individual employees printing records and storing them in paper files as the agency’s record.      1 Previously, the “print and file” method of preserving email records complied with NARA requirements and the agency’s recordkeeping policy and was a permissible method of preserving these records in the absence of an electronic recordkeeping system. “Print and file” remains a permissible method of recordkeeping with regard to non-email records, though NARA and OMB policy require agencies to manage permanent electronic records electronically by 2019. Although not the agency’s official recordkeeping policy, to save storage space on their computers employees sometimes archived information on computer hard drives and network drives. Storage of electronic records on a hard drive poses risks. Searching individual hard drives to fulfill a document request is a labor-intensive, time consuming process. This type of process poses an additional complication for the IRS, involving the need to safeguard any taxpayer data contained in electronic records created by employees who leave the agency. Additionally, computer hard drives are prone to equipment failure resulting in data loss, and the management of a large hard-drive inventory presents significant logistical challenges, even in the best of circumstances.  RECENT EFFORTS TO UPDATE ELECTRONIC RECORDS PROCEDURES The IRS considered putting a more-modern electronic records storage system in place in 2012, to bring the agency into compliance with a joint directive issued that year by NARA and the Office of Management and Budget (OMB). The Managing Government Records Directive (M-12-18) requires all federal agencies to have email in an electronically accessible format by December 31, 2016. At that time, the IRS decided it could not proceed with the upgrade because of recent budget cuts and the need to implement significant legislative mandates, such as the Affordable Care Act, the Foreign Account Tax Compliance Act, the Achieving a Better Life Experience Act and others. But the unprecedented volume and scope of document requests made by Congress and the public in 2013 in regard to the processing of applications for tax exempt status highlighted the need for the IRS to continue improving its maintenance of federal records that are in electronic form. Therefore, in October 2014 the IRS developed a policy and implemented an interim solution to archive email of IRS executives. The policy is consistent with NARA guidance allowing agencies to adopt a “Capstone” approach. The Capstone approach is used to schedule and manage email based on an individual’s role in the organization. Recognizing the agency’s most crucial records are those of its most senior officials, who set policy documenting agency business decisions, the IRS identified senior official email accounts as appropriate for permanent retention. The IRS’s Capstone Records Schedule was approved by NARA in October 2015, and established the required retention    2 periods for all IRS email. Currently, we are retaining email accounts of our most senior officials for permanent preservation. Going forward, we will also retain email accounts of all other IRS employees for a period of 20 years, subject to approval by NARA of our revised retention schedule. These are critical steps toward full compliance with OMB Directive M-12-18 because they give us the ability to efficiently preserve and retrieve the most significant IRS email records. Even so, this approach is not the ultimate solution for the preservation of electronic records of the agency. We recognized the need to end any reliance on individual hard drives as an archival records store, and instead to use network databases to preserve all official records that are electronically generated by our workforce – frontline employees as well as executives. We realized that we needed to implement an agency-wide solution. Moving toward that solution, in 2015 the IRS identified a cloud-based approach to meet the email retention requirements set out under OMB Directive M-12-18. By January 2016, we believed the plan was ready for implementation. We completed the design and secured funding. By March 2016, we had begun the appropriate requisitions to obtain hardware, software and support to meet the schedule. However, in that same month, an acquisition protest filed with the Government Accountability Office (GAO) challenged the procurement. In June 2016 the GAO upheld the protest, which put at risk our ability to have our solution in place by December 31, 2016. As a result, we worked to identify an alternative solution that involved in-house storage on servers at our data center. While this alternative approach will bring the IRS into compliance with the OMB directive, implementing it has required new procurement actions and significant rework. Accordingly, this means the IRS will not complete development and implementation of its enterprise-wide solution for all agency email until the fall of 2017, rather than by the OMB deadline of December 31, 2016. We have previously shared our updated timeline with members of Congress, NARA, and OMB, and have been keeping them updated on our progress. In fact, we understand the difficulties we face in this area are not unique. In its April 2016, Criteria for Managing Email Records in Compliance with the Managing Government Records Directive, NARA acknowledged the challenges federal agencies face, and said it recognized that the effective management of email records is an ongoing process. That being said, we are pleased to report that the IRS is well underway in its implementation of the new enterprise-wide solution. In fact, to date, we have migrated thousands of our employees’ email accounts into the new solution. At this point, we are on schedule for completion of this project in accordance with the updated timeline noted above that was provided to congressional and executive branch stakeholders.       3 BROADER IRS EFFORTS IN THE AREA OF RECORDS MANAGEMENT In addition to our interim and long-term approaches to efficient records management for email, the IRS has initiated substantial updates to other existing records management policies, procedures and practices, including actions in the following areas: <ul><li>Instant messaging. We updated policy and procedural guidance for electronic message usage and preservation. The policy provides specific guidance on the preservation of instant messages. Instant messages should not be used for substantive business communications. However, in the event a record is created while using instant messaging, the policy provides guidance on the requirement to save before the message is closed out. IRS employees have the ability to save instant messages to the Conversation History folder in their Outlook folders and archive the record as appropriate for preservation purposes.</li></ul> <ul><li>Separating employees. We enhanced our clearance procedures for employees who leave the IRS, so we could identify and preserve federal records of a separating employee before the employee departs, and to ensure the return of the employee’s equipment.</li></ul> <ul><li>Employee training. We recently released the first annual Records Mandatory Briefing for IRS employees and managers as required by NARA Bulletin 2017-01 and OMB Circular A-130. The course is designed to heighten understanding of records retention responsibilities.</li></ul> <ul><li>E-discovery. The IRS, like all government agencies, is seeing a significant increase in the role played by electronic evidence in litigation and government investigations. In order to effectively pursue or defend such cases – some of which have billions of dollars of tax revenue at stake – the IRS recognized the need for modern software tools to more efficiently review and analyze potential evidence in electronic form. We are in the process of upgrading our e-discovery capability to a modern, cloud-based set of tools that will allow us to more quickly and efficiently meet our discovery obligations.</li></ul> <ul><li>FOIA improvements. One of the challenges associated with managing FOIA requests is the complexity and level of effort associated with manual searches, retrievals, and redactions of responsive documents. To enhance this process, we are upgrading the software used for the day-to-day management of FOIA operations. Although the IRS already responds to the vast majority – more than 75 percent – of FOIA requests within 20 days, this new system will facilitate automation and improve effectiveness and efficiency.</li></ul> We believe that, taken together, the IRS’s efforts to improve electronic records management are an important step forward, because they will not only bring us into compliance with NARA standards and the OMB/NARA records management     4 directive, but will also greatly enhance our ability to timely respond to Congress and the courts, and to FOIA requests.  TIGTA’S REPORT ON RECORDS RETENTION The IRS appreciates the recent review by the Treasury Inspector General for Tax Administration (TIGTA) of the IRS’s records retention policies and procedures. We agree with the five recommendations in the report, and we believe they are helpful to our efforts at improvement in this area. The IRS has already made significant progress toward completing action on the recommendations, having implemented two of them and we are on track to complete all of them by the end of this year. While we agree with all of TIGTA’s recommendations, the IRS does have a somewhat different perspective on some of the findings in the report. For example, we do not agree with TIGTA’s finding that the IRS did not comply with NARA guidelines in place when TIGTA conducted the audit. At that time, IRS policies for maintaining official records were in full compliance with NARA standards for a paper system transitioning to an electronic system. Additionally, TIGTA’ s report includes pictures taken at three IRS locations containing a total of about 32,000 pieces of equipment – laptops, desktop computers and hard drives – stored at those facilities, but the report does not provide the context for the items stored and the security measures in place to protect these items. The vast majority of the items in the photographs were generated from the replacement of aged equipment. Under current IRS policies, electronic official records on an employee’s computer should be printed and placed in the official file or managed in another appropriate recordkeeping system. In addition, when an employee’s aged equipment is scheduled for replacement, it is the IRS’s practice to move the data from the old hard drive and add it to the new equipment during the replacement process. Consequently, data residing on aged equipment are copies of data on the new equipment. However, in instances where that may not be the case, we will assess and formulate a plan to address this. Chairman Buchanan, Ranking Member Lewis, and members of the Subcommittee, that concludes our statement. We would be happy to answer any questions.            5</div>

Progress Being Made on Record Retention, IRS Officials Say

Progress Being Made on Record Retention, IRS Officials Say

Internal Revenue Service

At a July 25 House Ways and Means Oversight Subcommittee hearing, two IRS officials testified that the implementation of a new enterprise-wide email solution is underway and that the agency has updated record-management policies for separating employees, employee training, discovery, and Freedom of Information Act requests.

At a July 25 House Ways and Means Oversight Subcommittee hearing, two IRS officials testified that the implementation of a new enterprise-wide email solution is underway and that the agency has updated record-management policies for separating employees, employee training, discovery, and Freedom of Information Act requests.