TIGTA Says IRS Needs to Improve Data Security at Volunteer Sites

Actions Are Needed to Improve the Safeguarding of Taxpayer Information
at Volunteer Program Sites

November 13, 2019

This report has cleared the Treasury Inspector General for Tax Administration disclosure review process and information determined to be restricted from public release has been redacted from this document.

Redaction Legend:

2 = Law Enforcement Techniques/Procedures and Guidelines for Law Enforcement Investigations or Prosecutions

Highlights

Final Report issued on November 13, 2019

Highlights of Reference Number: 2020-40-004 to the Commissioner of Internal Revenue.

IMPACT ON TAXPAYERS

The Volunteer Program plays an important role in helping the IRS improve taxpayer service and increase participation in the tax system. The program provides no-cost Federal tax return preparation and electronic filing to underserved segments of individual taxpayers, including low-income to moderate-income, elderly, disabled, and limited-English-proficient taxpayers. Because taxpayers who use return preparation services at volunteer sites disclose their Personally Identifiable Information and this information is coveted by identity thieves, the sites must safeguard taxpayer information.

WHY TIGTA DID THE AUDIT

Security over taxpayer data and protection of resources is a top IRS management challenge. The audit was initiated to assess the adequacy of and adherence to the IRS's volunteer site requirements to safeguard and protect sensitive taxpayer information.

WHAT TIGTA FOUND

The Stakeholder Partnerships, Education, and Communication function worked with its partners to heighten awareness of data security at volunteer sites. However, improvements are needed in some areas to strengthen the data security processes. For example, the IRS's partners participating in the Volunteer Program do not develop a written Information Security Plan for each site.

TIGTA's unannounced visits to 20 volunteer sites identified multiple security weaknesses at each site, such as 1) * * * 2 * * *, 2) site coordinators are unaware of security requirements, 3) sites using wireless connections to transmit taxpayer data did not complete a required risk assessment, and 4) * * * 2 * * *.

Finally, TIGTA found that procedures should be improved to reduce the risk of potential identity theft. * * * 2 * * *

WHAT TIGTA RECOMMENDED

TIGTA recommended that the IRS 1) issue guidance to its partners requiring them to develop an information security plan for each site; 2) require site coordinators to use the security feature included in the tax preparation software to restrict volunteers' access to prepared returns; 3) develop procedures to confirm that site coordinators are aware of security requirements; 4) ensure that site reviews include an assessment of compliance with security controls; 5) update procedures for partners to validate volunteers' identity using only Government-issued identification prior to participating in the Volunteer Program; 6) reinforce training for Stakeholder Partnerships, Education, and Communication function reviewers and site coordinators on how to report volunteers who are caught violating the standards of conduct; 7) develop procedures to evaluate security incidents at Volunteer Program sites to identify affected taxpayers whose information is at risk; and 8) emphasize to all volunteer sites and partners their responsibilities to evaluate and report to the IRS all partner-owned and IRS-loaned lost or stolen computers.

IRS management agreed with the recommendations and plans to take corrective actions.

---

November 13, 2019

MEMORANDUM FOR
COMMISSIONER OF INTERNAL REVENUE

FROM:
Michael E. McKenney
Deputy Inspector General for Audit

SUBJECT: 
Final Audit Report — Actions Are Needed to Improve the Safeguarding of Taxpayer Information
at Volunteer Program Sites (Audit # 201840010)

This report presents the results of our review to assess the adequacy of and adherence to the Internal Revenue Service's (IRS) volunteer site requirements to safeguard and protect sensitive taxpayer information. This review was part of our Fiscal Year 2019 Annual Audit Plan and addresses the major management challenges of Security Over Taxpayer Data and Protection of IRS Resources.

Management's complete response to the draft report is included as Appendix IV.

Copies of this report are also being sent to the IRS managers affected by the report recommendations. If you have any questions, please contact me or Russell P. Martin, Assistant Inspector General for Audit (Returns Processing and Account Services).

---

Table of Contents

Background

Results of Review

Appendices

Appendix I — Detailed Objective, Scope, and Methodology

Appendix II — Major Contributors to This Report

Appendix III — Report Distribution Lis

Appendix IV — Management’s Response to the Draft Report

Abbreviations

DSL	Dynamic Selection List
FY	Fiscal Year
IRS	Internal Revenue Service
SPEC	Stakeholder Partnerships, Education, and Communication
SSA	Social Security Number
TIGTA	Treasury Inspector General for Tax Administration
TIN	Taxpayer Identification Number

---

Background

The Volunteer Program plays an important role in helping the Internal Revenue Service (IRS) improve taxpayer service and increase participation in the tax system. The program provides no-cost Federal tax return preparation and electronic filing to underserved segments of individual taxpayers, including low- to moderate-income, elderly, disabled, and limited-English-proficient taxpayers. The Volunteer Program includes the Volunteer Income Tax Assistance and the Tax Counseling for the Elderly programs and sites operated in partnership with the U.S. military and community-based organizations.¹ The program is managed by the IRS's Stakeholder Partnerships, Education, and Communication (SPEC) function.² Figure 1 provides the number of Volunteer Program tax return preparation sites, volunteers, and returns prepared during Fiscal Years (FY) 2017 through 2019.

Figure 1: Volunteer Program Trends for FY 2017 Through FY 2019

Fiscal Year	Number of Volunteer Sites	Number of Volunteers	Tax Returns Prepared
2017	11,469	87,214	3,558,491
2018	11,044	84,646	3,559,838
2019	10,921	82,214	3,458,7373
Source: SPEC function website and IRS management.

Volunteer requirements to enroll, participate, and prepare tax returns

The IRS requires volunteers to meet certain requirements before they can participate in the Volunteer Program. The IRS indicates that these requirements help ensure that volunteers maintain the greatest degree of public trust and the highest standards of ethical conduct. Requirements include:

• Completing a registration process in which the volunteer provides his or her name and address along with a photo identification card such as a driver's license to a Volunteer Program partner for use in verifying the volunteer's identity.

• Completing the Volunteer Standards of Conduct training, which is mandatory for new volunteers and discretionary for returning volunteers. This training includes an explanation of the Volunteer Program's six standards of conduct (see Figure 2), information on how to report possible violations, and consequences of failure to adhere to the program requirements. In addition, all volunteers must pass a Volunteer Standards of Conduct test prior to volunteering at a site.

• Passing a mandatory tax knowledge test (new and returning volunteers). Requiring a volunteer to pass this test is an effort to ensure that tax returns are prepared accurately and tax laws are applied correctly.

• Signing and dating Form 13615, The Volunteer Standards of Conduct Agreement, agreeing to follow the Volunteer Standards of Conduct. Figure 2 is an excerpt from Form 13615 that outlines these standards.

Registry of volunteers permanently barred from participating in the Volunteer Program

The SPEC function maintains a Volunteer Registry of individuals permanently barred from participating in the Volunteer Program. This registry is a cumulative list of volunteers that site coordinators, SPEC function employees, and taxpayers reported to the SPEC function for violating one or more of the Standards of Conduct. IRS guidance states that SPEC function territory managers must review the registry and compare it to the annual volunteer lists such as Form 13533, Sponsor Agreements, or Form 13206, Volunteer Assistance Summary Reports. If a volunteer's name appears on the registry, the SPEC function territory manager must advise the partner or volunteer that they cannot participate in the program. If another attempt is made to participate, the territory manager must notify the Treasury Inspector General for Tax Administration (TIGTA) Office of Investigations.

As of March 20, 2019, the Registry included 62 individuals, of which 16 were added in Calendar Years 2016 through 2019. Figure 3 details the violations committed by the 16 individuals.

Figure 3: Volunteers Added to the Volunteer Registry in Calendar Years 2016–2019

Calendar Year	Number of Volunteers	Reasons for Adding the Volunteer to the Registry
2016	5	1 — Refused to wear ID badge. 1 — Took documents home to prepare out-of-scope returns. 1 — Knowingly prepared false tax returns. 1 — Knowingly prepared out-of-scope returns and accepted payments. 1 — Knowingly prepared false tax returns and deposited refunds into another account.
2017	7	2 — Knowingly prepared false tax returns. 1 — Unauthorized use of an Electronic Filing Identification Number4 and Site Identification Number.5 1 — Accepted payment for tax return preparation 1 — Failure to follow Intake/Interview and Quality Review Process.6 2 — Engaged in criminal and dishonest conduct.
2018	3	2 — Knowingly prepared false tax returns. 1 — Engaged in criminal and dishonest conduct.
2019	1	1 — Engaged in criminal, infamous, dishonest, notoriously disgraceful, or any other conduct deemed to have a negative effect on the Volunteer Program.
Source: SPEC function Volunteer Registry as a March 20, 2019.

Publication 4299, Privacy, Confidentiality, and Civil Rights, outlines volunteer site requirements to protect taxpayer information

Publication 4299 provides information on the requirements that volunteers must follow to protect taxpayer information. Volunteer sites are required to maintain a copy of Publication 4299 for reference. In addition to Publication 4299, the SPEC function holds monthly web conferences with volunteers to discuss current topics and may use this forum to discuss any security issues that may surface. Figure 4 details the requirements listed in Publication 4299 that sites must follow in an effort to protect taxpayer information.

Figure 4: Requirements to Safeguard Taxpayer Information

Publication 4299 Requirement	Publication 4299 Description
Privacy During the Interview	To the extent possible, arrange tax preparation assistance areas to prevent others from easily overhearing or viewing the information under discussion.
Requesting Taxpayer Information	When preparing tax returns, only information (i.e., Social Security Number (SSN), birth dates, bank account information) that is necessary and relevant should be requested. The information provided is entrusted to the volunteer with the taxpayer’s confidence that it will not be shared or used in any unauthorized manner.
Validating Taxpayer's Identity and Identification Numbers	Volunteers preparing tax returns must confirm the identity of each taxpayer signing the tax return to prevent identity theft and tax fraud. The volunteer must review an original photo identification such as valid driver’s license.
Signing the Tax Return	A taxpayer must sign the tax return, whether paper-filed or Form 8879, IRS e-file Signature Authorization, for an electronically filed tax return.
Sharing the Information	Information provided for tax return preparation should not be shared with anyone who does not have a need to know. Individuals have a need to know if their involvement is required to process the information in its final disposition (i.e., guidance in tax return completion, electronically transmitting the return, and reviewing a tax return and source documents).
Sharing Taxpayer Information Through Nontraditional Channels	Information sharing is normally done face-to-face at the site. However, there may be situations in which other communication channels (i.e., advice from a more experienced preparer located offsite, discussing rejected returns) may be more efficient in the process of preparing and filing returns.
Taxpayer Consent	Partners are required to provide written notice to taxpayers and receive signed consent when using or disclosing taxpayer information for purposes other than preparing returns (i.e., current, prior, or subsequent year returns).
Use of Wireless Devices	The IRS recommends that partners and volunteers use wired connections when transmitting taxpayer information via the Internet. Partners and volunteers who, after assessing their individual risks, decide to use wireless devices to transmit taxpayer information to the tax preparation software provider should, at a minimum, use certain specifications.
Protecting the Information	Once the tax return is complete and the taxpayer has left, partners and volunteers must ensure that the individual information provided during return preparation is protected.
Providing a Safe Environment for Information	Partners and volunteers must implement a process to ensure that taxpayer information is adequately protected at all times. For example, the process must: Ensure that tax-related information provided during the course of tax return preparation is under the care of volunteers at all times and is maintained in accordance with partner security and safeguarding guidelines. Implement password protection on computers used to prepare returns. Sign off and lock computers when not in use and use locked storage for tax-related documents that are retained after the taxpayer leaves the site. Dispose of tax-related information in a timely manner. Delete taxpayer data as information may not be stored on partner-owned or IRS-loaned equipment once the filing season is completed. Guidelines also require information on computers to be deleted/wiped as part of the site closing  activities. Ensure that computers are in the control of a volunteer at all times while in use and stored in a controlled, limited-access, locked location when not in use. Record the make, model, and serial number of all computers used in the event a report of a lost or stolen computer must be made.
Reporting Stolen and Lost Computers	It is necessary to ensure that all incidents of stolen and lost computers (including partner-owned) are reported to the IRS. As a condition of computers loaned to partners from the IRS, the recipient agrees to notify the IRS within 48 hours of the incident. Partners are also requested to notify the IRS within 48 hours.
Source: IRS Publication 4299.

In addition to establishing Volunteer Program procedures and developing volunteer training, the SPEC function performs reviews to monitor volunteer compliance with site security requirements and Volunteer Standards of Conduct. These reviews assess whether sites have a process to 1) identify every volunteer who prepares, reviews, or changes returns; 2) secure and protect equipment; 3) safeguard and properly destroy taxpayer information; and 4) ensure that taxpayer consent notices are secured as appropriate. In addition, these reviews ensure that volunteers are certified in the Volunteer Standards of Conduct. Figure 5 provides the number of these reviews completed in FY 2018.

Figure 5: SPEC Site Reviews in FY 2018

Type of Site Review	Total Reviews
Quality Statistical Sample — Unannounced site visits performed by SPEC Headquarters to promote and measure compliance with Quality Site Requirements.	104
Field Site Visit — Unannounced site visits performed by SPEC field to assess site adherence to Quality Site Requirements and Volunteer Standards of Conduct.	1,556
Remote Site Review — Announced reviews performed by SPEC field via telephone to assess site adherence to Quality Site Requirements and Volunteer Standards of Conduct.	1,064
Source: TIGTA analysis of Forms 6729 and 6729-D.7

Procedures for identifying lost or stolen computers

Each year, the SPEC function loans computers to some volunteer sites for use in preparing tax returns. For example, for FY 2019 the IRS loaned 5,786 computers to partners.

Publication 4299 includes the requirement for volunteer sites to report all incidents of stolen and lost computers to the IRS. Volunteers are required to notify the IRS within 48 hours for stolen or lost IRS-owned computers and are requested to notify the IRS within 48 hours for stolen or lost partner-owned computers. For stolen IRS computers, volunteers must notify local law enforcement immediately. The SPEC function then reports the incident to the IRS's Computer Security Incident Response Capability office, the TIGTA Office of Investigations, IRS management, and the IRS's Computer Depot located in Brookhaven, New York. In addition, volunteer sites are required to evaluate the risk associated with any loss of taxpayer information and, if warranted, notify the taxpayers.

This review was performed at the Wage and Investment Division Headquarters in Atlanta, Georgia, during the period December 2018 through June 2019. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objective. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective. Detailed information on our audit objective, scope, and methodology is presented in Appendix I. Major contributors to the report are listed in Appendix II.

Results of Review

Security over taxpayer data and protection of resources is a top management challenge for the IRS in FY 2019. Taxpayers who use return preparation services at volunteer sites are required to disclose sensitive Personally Identifiable Information that includes their name, address, SSN, birth date, and bank account information to a volunteer for use in preparing their tax return. This sensitive information is highly coveted by identity thieves. Thus, the IRS must implement effective procedures to ensure that the volunteer sites adequately safeguard taxpayer information. Our review identified that the SPEC function has worked with its partners to heighten awareness of data security at volunteer sites. However, improvements are needed to strengthen data security processes.

An Information Security Plan Is Not Developed for Each Volunteer Program Site

The IRS does not require its partners participating in the Volunteer Program to develop a written information security plan for each site where taxpayers are provided free tax return preparation. An information security plan is a formal document that provides an overview of the security controls in place or planned to protect taxpayer information. For example, the Federal Trade Commission's Safeguards Rule⁸ requires financial institutions to develop a written information security plan that describes the program to protect customer information. The security plan must:

• Designate one or more employees to coordinate the information security program.

• Identify and assess the risks to customer information in each relevant area of its operation and evaluate the effectiveness of the safeguards for controlling these risks.

• Evaluate and adjust the tax preparation program in light of relevant circumstances, including changes in the firm's business or operations, or the results of security testing and monitoring.

When we raised our concerns to SPEC function management, they stated that they do not believe the requirement for financial institutions to develop a written information security plan applies to its partners in the Volunteer Program. Management stated that IRS Publication 4557, Safeguarding Taxpayer Data — A Guide for Your Business, defines a Financial Institution covered by the Safeguards Rule as professional tax preparers, and because volunteers are not professional tax preparers, the Safeguards Rule does not apply. We disagree. In fact, IRS Publication 4600, Tips for Safeguarding Taxpayer Data, contradicts management's position. According to Publication 4600, financial institutions covered by the Safeguards Rule include return preparers, data processors, transmitters, service providers, and others who are significantly engaged in providing financial products or services that include preparing and filing tax returns. Volunteers are significantly engaged in preparing and filing tax returns and, as such, we believe the Safeguards Rule applies and a security plan should be developed for each site in an effort to protect taxpayer data.

Recommendation

Recommendation 1: The Commissioner, Wage and Investment Division, should issue guidance to Volunteer Program partners requiring the development of an information security plan for each of their sites. The guidance should detail the elements to be included in this plan and the need to review the plan with volunteers and retain the plan at the site. IRS site review procedures should also be updated to include verification of the information security plan.

Unannounced Site Visits Identify Numerous Site Security Weaknesses

Our unannounced visits to 20 judgmentally⁹ selected volunteer sites during February and March 2019 identified multiple security weaknesses at each of these 20 sites. The sites we visited were also sites visited by SPEC function reviewers in Calendar Year 2018. For each of these 20 sites, the SPEC reviewers concluded that the site was fully compliant with security requirements. Examples of the security weaknesses that we identified include:

• IRS policies and procedures do not restrict volunteer access to tax information after returns are prepared. Our review identified that all volunteers who prepare returns at a site have the capability to * * * 2 * * *. SPEC function management did not develop a policy requiring site coordinators to restrict volunteers' access to prepared returns. The tax preparation software used by volunteer sites has a security feature that would restrict volunteer access to prepared returns, * * * 2 * * *. Publication 4557 states that organizations should develop policies for whether or how employees can access customer data remotely. Management stated that there are no specific expectations for volunteers accessing tax returns after hours. Instead, management expects partners to take appropriate steps to ensure the security of taxpayer data, which may include restricting after-hours access to the data.

• Site coordinators are unaware of security requirements in Publication 4299. Site coordinators at 16 sites indicated that they were unaware of Publication 4299. The SPEC function officials do not ensure that site coordinators are aware of the security requirements contained in this publication, nor do the SPEC function's site reviews determine whether site coordinators are familiar with Publication 4299 and a copy is available for volunteers to review at the site.

• Sites using wireless connections to transmit taxpayer information did not complete the required risk assessment. Wireless connection to the Internet to prepare and transmit tax returns to the IRS was used at 11 of the 20 sites we visited. Publication 4299 requires partners to assess their individual risks before using wireless devices to transmit taxpayer information. However, for the 11 sites, the partners did not complete the required risk assessment. * * * 2 * * *. When we discussed this issue with the SPEC function reviewers who visited these sites during the prior year, they indicated that they did not check for these security standards even though their job aid for conducting site visits instructs them to check site compliance with Publication 4299 requirements. SPEC function management acknowledged that site reviewers are not trained to assess security requirements for a wireless network.

• Improper and unsecured retention of taxpayer documents occurred. * * * 2 * * *. Publication 4299 requires sites to:

  • Securely store taxpayers' documents away from the flow of foot traffic, out of the reach of clients.

  • Use locked containers for printed documents containing taxpayer information during and after operating hours and shred or burn information not returned to the taxpayer. Taxpayer information may be maintained by partners until they close the site at the end of the site's operational year.

  • Follow Internal Revenue Code Section 7216 procedures for securing taxpayer-signed consent forms if the partners have a need to retain and use the taxpayers' information for purposes other than return preparation.

  The SPEC function's reviewers did not identify these instances of * * * 2 * * * during their site reviews because their guidelines allow them to rely on oral statements from volunteers rather than physically observing documentation retained at the site. For example, Remote Site Reviews are conducted via telephone rather than visiting the site. * * * 2 * * *. For another site, the SPEC function had completed a Quality Statistical Sample review in which the reviewer relied on oral testimony from the site coordinator rather than observing the documentation at the site. Finally, at the sites where we found that volunteers took * * * 2 * * *, we found that the SPEC function reviewers did not ask the volunteers about this practice. One reviewer we interviewed acknowledged that if he or she had been aware of this practice, he or she would have rated the site as not compliant.

When security weaknesses exist at the volunteer sites, taxpayers' personal information is more susceptible to theft and misuse.

Recommendations

The Commissioner, Wage and Investment Division, should:

Recommendation 2: Require site coordinators to use the security feature included in the tax preparation software to restrict volunteers' access to prepared returns.

Recommendation 3: Develop processes and procedures to confirm site coordinators are aware of security requirements and hold discussions with volunteers at the sites to review these security requirements.

Recommendation 4: Ensure that site reviews include an assessment of compliance with security controls outlined in Publication 4299. This assessment should determine if the site being reviewed uses a wireless computer connection and, if so, that a required risk assessment is completed. The assessment should also include steps to identify and verify proper storage of taxpayer information.

Improvements Are Needed to Better Protect Taxpayers From Potential Identity Theft

* * * 2 * * *.

Site coordinators are unaware of their responsibility to report unscrupulous volunteers to be added to the registry and removed from the program. Our interviews with site coordinators at 17 of the 20 sites we visited found that they were unaware of the registry or procedures to add volunteers to the registry. * * * 2 * * *.

* * * 2 * * *. Of additional concern is that our interviews with six judgmentally sampled SPEC function reviewers, who conduct site assessments, identified that they do not have a consistent understanding of the Volunteer Standards of Conduct violations that warrant referring a volunteer to the SPEC function director for addition to the registry.

Procedures are not sufficient to protect taxpayers from potential identity theft when a security incident occurs at a volunteer site

The SPEC function did not implement adequate procedures to protect taxpayers from the potential risk of identity theft when their tax information is lost in a security incident at a volunteer site. Security incidents include data breaches, lost or stolen computers, and taxpayers whose returns were prepared by volunteers who were caught violating the Volunteer Standards of Conduct. For example, the Taxpayer Identification Numbers (TIN) of taxpayers who had their returns prepared by volunteers who were caught violating the Standards of Conduct and removed from the program were not reported to the Return Integrity and Compliance Services function for evaluation and possible addition to the Dynamic Selection List (DSL)¹⁰ for identity theft monitoring.

* * * 2 * * *.

Under current SPEC function procedures, the TINs of the taxpayers involved in the fraudulent filing of these tax returns would not be added to the DSL to protect these individuals from the filing of fraudulent tax returns using their information. * * * 2 * * *.

When we asked SPEC function management why they had not implemented procedures to add the TINs of taxpayers affected by security incidents to the DSL, they stated that no taxpayer information should be stored on a computer that is lost or stolen. However, we informed management that the volunteers have the capability to * * * 2 * * *. Thus, if a computer is lost or stolen, taxpayer information may be stored on the computer. SPEC function management then indicated they are receptive to adding the TINs of taxpayers affected by security incidents to the DSL for cases in which they determine that taxpayer data have been compromised.

Sites are not complying with procedures when computers are lost or stolen

Our review identified that the required Form 13747, Checklist for Lost/Stolen Equipment, was not prepared for five of the 36 IRS-loaned computers that were reported as lost or stolen in Calendar Years 2016 through 2018. In addition, our review of the 19 Forms 13747 that were prepared for the remaining 31 lost or stolen computers identified that the forms lacked information that the SPEC function needed to evaluate these incidents. For example, all

19 forms had missing checklist items or a vague explanation of the incident. Information missing included details on whether a police report was filed and whether sensitive data were stored on the computer. Despite this missing information, the SPEC function concluded that none of the computers stored taxpayer information and no taxpayers needed to be notified.

IRS procedures require sites to prepare a Form 13747 to report incidents of lost or stolen equipment. Volunteer Program partners are required to provide incident information such as the computer's serial number, description of events that occurred, and the taxpayer data at risk to their local SPEC function relationship manager or territory office. The territory office must then complete an incident assessment and supporting documentation within 10 days. However, when site coordinators do not properly report to the IRS all lost or stolen computers or complete the required documentation, the risks increase to the taxpayers whose information may be stored on the computers.

For the five computers lost or stolen, SPEC function management indicated that a Form 13747 was not required for three computers because the computer was lost in transit to the tax partner and that a Form 13747 was not required for the other two computers because the computers were recovered within a week. However, we believe that a Form 13747 should have been prepared for each of these incidents.

Finally, the main reason for the insufficient reporting of lost or stolen computers is the SPEC function reviewers' and site coordinators' inadequate knowledge of the requirement to report these incidents. *  * * 2 * * *. This may be the reason that no lost or stolen partner-owned computers were reported to the SPEC function prior to our site visits. When we brought this issue to management's attention, they stated that no taxpayer information should be stored on a computer that is lost or stolen and, as such, taxpayer data are not at risk.

Recommendations

The Commissioner, Wage and Investment Division, should:

Recommendation 5: Update procedures for partners to validate volunteers' identity using only Government-issued identification prior to participating in the Volunteer Program.

Recommendation 6: Reinforce training for SPEC function reviewers and site coordinators on how to report volunteers who are caught violating the Volunteer Standards of Conduct. Site reviewers should confirm an understanding of these processes and procedures with site coordinators as part of the SPEC function's reviews. Training should also address the importance of SPEC function territory managers using the Volunteer Registry to ensure that banned volunteers do not regain entry into the program.

Recommendation 7: Develop procedures to evaluate security incidents at Volunteer Program sites to identify affected taxpayers whose information is at risk and forward their TINs to the Return Integrity and Compliance Services function for evaluation and potential inclusion on the DSL. The procedures should include steps to identify taxpayers whose returns were prepared by a volunteer who the SPEC function banned from the Volunteer Program.

Recommendation 8: Emphasize to all volunteer sites and partners their responsibilities in Publication 4299 to evaluate and report to the IRS all partner-owned and IRS-loaned lost or stolen computers. Site reviewers should confirm the site coordinators' understanding of these procedures during the SPEC function's site reviews. In addition, when lost or stolen computers are reported, ensure that Forms 13747 are prepared and include all information needed to determine the extent to which taxpayer data may be at risk.

---

Appendix I

Detailed Objective, Scope, and Methodology

Our overall objective was to assess the adequacy of and adherence to the IRS's volunteer site requirements to safeguard and protect sensitive taxpayer information. To accomplish our objective, we:

I. Determined if the SPEC function implemented sufficient controls to safeguard taxpayer data at Volunteer Program sites.

II. Evaluated IRS processes to identify and address data breaches at Volunteer Program sites, including lost/stolen computers.

III. Determined if the SPEC function implemented controls to ensure the suitability of volunteers.

Internal controls methodology

Internal controls relate to management's plans, methods, and procedures used to meet their mission, goals, and objectives. Internal controls include the processes and procedures for planning, organizing, directing, and controlling program operations. They include the systems for measuring, reporting, and monitoring program performance. We determined that the following internal controls were relevant to our audit objective: 1) processes and procedures used to implement controls to safeguard taxpayer data at Volunteer Program sites; 2) processes and procedures to identify and address data breaches at Volunteer Program sites, including lost/stolen computers; and 3) processes and procedures used to ensure the suitability of volunteers. We evaluated these controls by reviewing policies and procedures, interviewing employees and management, and analyzing data.

---

Appendix II

Major Contributors to This Report

Russell P. Martin, Assistant Inspector General for Audit (Returns Processing and Account Services)

William A. Gray, Director

Levi Dickson, Audit Manager

Stephen Elix, Lead Auditor

Robert Howes, Senior Auditor

---

Appendix III

Report Distribution List

Deputy Commissioner for Services and Enforcement

Commissioner, Wage and Investment Division

Chief, Communications and Liaison

Director, Customer Assistance, Relationships, and Education, Wage and Investment Division

Director, Stakeholder Liaison Field, Communications and Liaison

Director, Stakeholder Partnerships, Education, and Communication, Wage and Investment Division

Director, Enterprise Audit Management

---

Appendix IV

Management's Response to the Draft Report