Menu
Tax Notes logo

IRS Must Better Monitor Laptops When Employees Leave, TIGTA Says

AUG. 10, 2016

2016-10-056

DATED AUG. 10, 2016
DOCUMENT ATTRIBUTES
  • Institutional Authors
    Treasury Inspector General for Tax Administration
  • Subject Area/Tax Topics
  • Jurisdictions
  • Language
    English
  • Tax Analysts Document Number
    Doc 2016-17442
  • Tax Analysts Electronic Citation
    2016 TNT 168-11
Citations: 2016-10-056
Improvements in Controls Are Needed for Laptop Computers Recovered When Employees Separate

 

August 10, 2016

 

 

This report has cleared the Treasury Inspector General for Tax Administration disclosure review process and information determined to be restricted from public release has been redacted from this document.

 

HIGHLIGHTS

 

 

Final Report issued on August 10, 2016

 

 

Highlights of Reference Number: 2016-10-056 to the Internal Revenue Service Human Capital Officer and Chief Technology Officer.

IMPACT ON TAXPAYERS

During Fiscal Year (FY) 2014, more than 4,100 full-time, permanent employees separated from the IRS. It is important for the IRS to recover computers from separating employees to prevent unauthorized access to taxpayer information and the loss of Government equipment.

WHY TIGTA DID THE AUDIT

The overall objective of this audit was to determine whether IRS management implemented policies and procedures designed to provide reasonable assurance that laptop computers are returned when employees separate from the IRS.

WHAT TIGTA FOUND

While all laptop computers from a random sample of FY 2014 employee separations were returned, the process designed to provide reasonable assurance that laptop computers are returned when employees separate was either not functioning as intended or not always followed. TIGTA found substantial recordkeeping problems and estimates that IRS separation records concerning the recovery of laptop computers were inaccurate for more than 850 (21 percent) of the more than 4,100 employee separations in FY 2014.

The IRS has designed controls to verify that laptop computers are recovered when employees separate. The controls include a process in which managers of the separating employees fill out an electronic separation record to document if laptop computers are recovered and Information Technology office officials verify the return of the laptop computers on a separate inventory system.

However, reconciling separation records with Information Technology office computer inventory records was a lengthy process that included considerable challenges for TIGTA and the IRS. For example, 18 separation records indicated the separated employees returned their laptop computers when computer inventory records indicated computers were not assigned to the separated employees. In addition, six separation records indicated that separated employees were not assigned laptop computers when computer inventory records indicated that laptop computers were assigned and returned. In addition, TIGTA identified one laptop that was returned to the IRS but was not entered back into the IRS's computer inventory until TIGTA brought it to the IRS's attention.

WHAT TIGTA RECOMMENDED

TIGTA recommended that the IRS Human Capital Officer update separating employee clearance guidance, provide training for managers on the updated procedures; and work with Information Technology office management to develop procedures to reconcile and resolve discrepancies between separation records and computer inventory records when employees separate.

In their response, IRS management agreed with TIGTA's recommendations. The IRS stated that it has updated separating employee clearance guidance for documenting the return of information technology equipment and provided training, and plans to provide additional guidance updates and training. Also, the IRS plans to develop standard operating procedures to reconcile and resolve discrepancies between separation records and computer inventory records.

 

* * * * *

 

 

August 10, 2016

 

 

MEMORANDUM FOR

 

HUMAN CAPITAL OFFICER

 

CHIEF TECHNOLOGY OFFICER

 

 

FROM:

 

Michael E. McKenney

 

Deputy Inspector General for Audit

 

 

SUBJECT:

 

Final Audit Report -- Improvements in Controls Are Needed

 

for Laptop Computers Recovered When Employees Separate

 

(Audit # 201510024)

 

 

This report presents the results of our review to determine whether Internal Revenue Service (IRS) management implemented policies and procedures designed to provide reasonable assurance that laptop computers are returned when employees separate from the IRS. This review is included in our Fiscal Year 2016 Annual Audit Plan and addresses the major management challenge of Security for Taxpayer Data and IRS Employees.

Management's complete response to the draft report is included as Appendix V.

Copies of this report are also being sent to the IRS managers affected by the report recommendations. If you have any questions, please contact me or Gregory D. Kutz, Assistant Inspector General for Audit (Management Services and Exempt Organizations).

                           Table of Contents

 

 

 Background

 

 

 Results of Review

 

 

      Clearance Module Records Do Not Provide Reasonable Assurance That

 

      Laptop Computers Are Returned When Employees Separate

 

 

           Recommendation 1:

 

 

           Recommendation 2:

 

 

 Appendices

 

 

 Appendix I   -- Detailed Objective, Scope, and Methodology

 

 

 Appendix II  -- Major Contributors to This Report

 

 

 Appendix III -- Report Distribution List

 

 

 Appendix IV  -- Outcome Measures

 

 

 Appendix V   -- Management's Response to the Draft Report

 

 

                             Abbreviations

 

 

 FY              Fiscal Year

 

 

 IRS             Internal Revenue Service

 

 

 IT              Information Technology

 

 

 TIGTA           Treasury Inspector General for Tax Administration

 

Background

 

 

During Fiscal Year (FY)1 2014,2 more than 4,000 full-time, permanent employees separated from the Internal Revenue Service (IRS) through retirement, resignation, death, etc. This includes 186 employees who separated during a pending disciplinary case (including criminal misconduct). Government equipment, such as laptop computers (hereafter referred to as laptops), must be recovered from employees prior to the effective date of separation to prevent unauthorized access to taxpayer information and the loss of Government equipment.

In FY 2006, the IRS began using the Separating Employee Clearance module3 (hereafter referred to as clearance module) to certify that assigned laptops are recovered when employees separate from the IRS or to notate why an item is unrecoverable. The Separating Employee Clearance process is initiated when the employee, manager, or Human Resources Specialist submits a Personnel Action Request4 involving the separation of an employee, which generates a clearance module record upon approval. Managers should submit a request to the Information Technology (IT) office5 for an inventory list for separating employees if they are uncertain what equipment is assigned to the employee. Managers are also responsible for entering into the clearance module: laptops that departing employees should return; and when, where, and how the laptops will be returned. The approved record will move to a third-party work list for confirmation that the items were recovered.

According to IRS policy, after recovery of a laptop from a separating employee, the manager should create an equipment return services ticket to arrange for return of the equipment to the IT office. When the service ticket is received by the IT office technician, the technician retrieves the equipment, reviews the laptop's barcode6 to assure it is the correct computer, arranges for shipment of the equipment to the IT office, and updates the IRS's asset inventory system7 with the equipment's location. IT office functional coordinators should also review the inventory assigned to the separating employee and confirm that an IT office technician has picked up the equipment prior to approving the clearance module records for closure. Equipment should then be shipped to the Brookhaven, New York; Memphis, Tennessee; or Ogden, Utah, equipment depots based on their useful life and warranty.

There is an additional risk when an employee separates under adverse conditions. When an employee is terminated for an adverse reason, managers are required to collect the laptop immediately to avoid loss of the computer or the potential inadvertent release of sensitive information by the separated employee. If the manager cannot recover a separating employee's laptop, a report should be submitted to the Computer Security Incident Response Center office explaining the circumstances of the non-recovery and to the Treasury Inspector General for Tax Administration's (TIGTA) Office of Investigations.

This review was performed with information obtained from the IRS Agency-Wide Shared Services office located at the IRS Headquarters in Washington, D.C., and at the IRS IT offices in Fort Lauderdale, Florida, and New Carrollton, Maryland, during the period October 2015 through May 2016. Following the conclusion of fieldwork, the IRS Payroll Services function, responsible for separating employee clearance guidance was moved from the Agency-Wide Shared Services office to the IRS Human Capital Office. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objective. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective. Detailed information on our audit objective, scope, and methodology is presented in Appendix I. Major contributors to the report are listed in Appendix II.

 

Results of Review

 

 

While we ultimately found that all laptops from a random sample of FY 2014 employee separations were returned,8 the process designed to provide reasonable assurance that laptops are returned when employees separate was either not functioning as intended, or not always followed. We found substantial recordkeeping problems for laptops that were returned when employees separated from the IRS, which resulted in a lengthy process and considerable challenges for TIGTA and the IRS to reconcile clearance module records and IT office computer inventory records.

It is important for the IRS to recover laptops because they may contain Personally Identifiable Information that could be used to harm taxpayers and IRS employees, and to prevent the loss of valuable assets, which may contain files, documents, and e-mails needed to accomplish the IRS's mission. Accordingly, the IRS designed controls to verify that laptops are recovered when employees separate. The controls include a process in which managers fill out an electronic separation record to document if laptops are recovered, and IT office officials verify the return of the laptop on a separate inventory system.

While the IRS does not offer a comprehensive Separating Employee Clearance training course addressing the requirements for obtaining laptops and other equipment from separating employees for new or experienced managers, it does have information resources available for its managers. For example, a clearance module overview is available through a payroll newsletter and leaders alerts, which are posted to the IRS intranet site. The Separating Employee Clearance help desk also hosts a monthly teleconference in which managers can ask questions about the process and discuss the Separating Employee Clearance manager's handbook, which is available on the Employee Resources Center.9

Clearance Module Records Do Not Provide Reasonable Assurance That Laptop Computers Are Returned When Employees Separate

Based on our review of a stratified random sample of clearance module records for FY 2014 employee separations,10 we estimate that IRS clearance module records are inaccurate for 882 (21 percent) of the 4,106 employee separations in FY 2014 with laptops.11 We believe that errors occurred because the clearance module does not list computer equipment assigned to employees for managers to know what should be recovered when employees separate. In addition, 1) managers change roles frequently and are often not in the same position as when laptops were issued, 2) managers did not understand the clearance process, which had not been updated in the Internal Revenue Manual, for documenting the return of laptops in the separating clearance module, 3) managers may not refer to the payroll newsletters and e-mail alerts, and 4) managers may have questions about the clearance process at times other than when the monthly teleconferences are held. Further, IT office functional coordinators approved clearance module records without resolving discrepancies between the clearance module and IT office inventory records.

Clearance module and IT inventory records were inaccurate

We determined that 30 (20 percent) of the 149 clearance module records for separated employees in our stratified random sample did not accurately reflect whether laptops were recovered. This occurred because IRS managers did not input correct computer status12 information in the clearance module. To verify that laptop computers were recovered, we compared clearance module records to IT office inventory records to determine if laptops that were listed as assigned to employees prior to their separation had been updated as returned after the employee separated.13 Specifically, we identified the following discrepancies between the clearance module and the IT office inventory records:

  • Eighteen clearance module records inaccurately indicated that the separated employees returned a laptop when the IT inventory records indicated laptops were not assigned14 to those employees.

  • Six clearance module records inaccurately indicated that separated employees were not assigned a laptop when IT inventory records indicated that laptops were assigned and returned.

  • Six clearance module records were never updated after the records were created to show whether the laptops were returned or unrecoverable.15

 

The IT office functional coordinator is required to approve clearance module records, but we did not identify any requirement for the coordinator to identify discrepancies when comparing clearance module records to the IT office inventory records. Discrepancies between clearance module records and IT office inventory records call into question whether laptops were assigned and returned. According to IT office management, their review of the clearance module record is to confirm that equipment that was listed in IT office inventory records as assigned to the separating employee was returned to the IT office. As a result, IT office employees did not assure that clearance module input errors were corrected. Further, when managers entered equipment as returned in clearance module records, but the equipment was never assigned to the employee in IT office inventory records, the IT office inventory records were not always corrected.

We also identified three (2 percent) errors in the IT office inventory records in which there were discrepancies between the clearance module records and IT office inventory records.

  • IT inventory records indicated a laptop was still assigned to an employee two years after separation. However, the clearance module record computer status input by the separated employee's manager indicated that a laptop was "not applicable" (not assigned). When we brought this to the IRS's attention, officials verified that the manager had recovered the laptop and returned it to the local IT office. Although IT office officials had the computer in their possession, the IT inventory record was not updated to show the computer was returned and in stock until we brought it to the IRS's attention. As such, the laptop was not available to be reassigned for use by current employees.

  • IT office inventory records did not indicate two laptops were assigned and returned from separated employees. However, the clearance module records indicated that laptops were issued and returned by the employees at separation. When we brought this to the IRS's attention, officials verified that the managers had recovered the laptops.

    • IRS officials confirmed one laptop was returned to the local IT office, but the IT office inventory record was not updated to show the computer had been assigned to the employee.

    • IRS officials confirmed that the laptop used by the second employee was in IT inventory after the employee's separation. However, the IT office inventory records appear to not have been updated to show the computer was assigned to the employee and returned prior to separation.

Separated employees with no clearance module record

To determine if laptop computers are returned when a clearance module record is not created, we selected and analyzed a judgmental sample of 28 of 41 full-time,16 permanent employees who separated in FY 2014 and did not have a clearance module record, for which other employees in their job series were issued a laptop based on the IRS Standardized Profile Listing.17 We determined that 11 of 28 employees had not been assigned laptops, and 15 of 28 employees were assigned computers that were recovered and accurately accounted for in the IT office inventory when the employees separated. However, we also determined that IT office inventory records were inaccurate for two (7 percent) of the 28 employee separations.

  • One laptop was not assigned to the separated employee in IT office inventory records. However, documentation obtained from the employee's manager, and from the IT office requesting that the IT office technician pick up the computer, indicated it was recovered and returned to the local IT office.

  • One laptop was assigned to the separated employee in IT office inventory records but was not properly updated as recovered when the employee separated. Therefore, the laptop remained assigned to the employee 18 months after separation and was not available for use by current IRS employees. IRS management located the laptop at the local IT office when we brought it to their attention.

 

Clearance module records were inaccurate for employee adverse separations

While we determined that all of the laptops that were assigned to employees were recovered when the employees separated, clearance module records were inaccurate for four (14 percent) of 28 employees from a judgmental sample18 of employees who separated under adverse conditions. This occurred because of the following:

  • Two laptops were recorded as unrecoverable in the clearance module in error. We determined that one employee was not assigned a laptop, and the clearance module should have been updated by the manager to indicate "not applicable" when the employee separated. The second employee was assigned a laptop, but it was returned and the manager should have updated the clearance module to indicate "returned."

  • One laptop was not recorded in the clearance module in error. We determined that the employee was assigned a laptop, and the clearance module incorrectly indicated that the laptop was "not applicable." The IT office inventory record showed a laptop was assigned and returned.

  • One laptop was recorded as "initiated" in the clearance module in error. We determined that the employee was not assigned a laptop, and the clearance module should have been updated to "not applicable." The IT office inventory record showed a laptop was not assigned.

 

The IT office functional coordinator did not resolve the four discrepancies, when comparing the IT office inventory records to the clearance module records, prior to approving the clearance module records.

Some actions have been taken to improve the clearance process

In response to a previous TIGTA audit of the IT office inventory system,19 the IT office created an integrated project team that determined employees did not understand the process for returning equipment to the IT office. As a result, the Separating Employees Clearance manager's handbook was updated on May 29, 2015. However, the revised handbook does not include detailed instructions needed for the managers to correctly input status information. For example, the handbook does not explain that "Laptop" is the default entry in the IT office section of the clearance module, what status should be selected if the employee is not assigned a laptop computer, or the status that should be selected when the laptop is returned or unrecoverable. In addition, according to Agency-Wide Shared Services management, their monthly teleconferences for managers with separating employees focuses on instructing managers on creating separation clearance records, but does not include detailed instructions on documenting the return of information technology items such as laptops.

Recommendations

The IRS Human Capital Officer should:

Recommendation 1: Update separating employee clearance guidance to include instructions for selecting the appropriate status for laptops and provide training for managers on the updated procedures.

 

Management's Response: IRS management agreed with the recommendation and stated that the IRS Human Capital Officer updated the HR Connect Separating Employee Clearance Manager/Proxy Guide to include Desktop (computer) as an additional information technology item for tracking purposes. In addition, the following actions were taken:
  • Desktop, Printer, Blackberry/SmartPhone, and Wireless Air Cards were updated to reflect that managers are required to comment on the items.

  • The HR Connect Separating Employee Clearance Manager/Proxy Guide was updated to reflect information for selecting the appropriate Estimated Return Method status for information technology equipment, including Not Applicable and Unrecoverable, and six training sessions were completed to provide an overview of the HR Connect updates, which included changes to the information technology items.

 

The IRS Human Capital Office and the IT office plans to provide additional HR Connect Separating Employee Clearance Manager/Proxy Guide updates to include additional clarification of the Return Status and Comments, and Human Capital Office Personnel Systems will host HR Connect Separating Employee Clearance Manager/Proxy Guide training sessions to share the updated guidance.

 

Recommendation 2: Work with IT office management to develop procedures to reconcile and resolve discrepancies between clearance module records and IT office inventory records when employees separate.

 

Management's Response: IRS management agreed with the recommendation and tated that the IRS Human Capital Office took the following actions:
  • Updated the HR Connect Separating Employee Clearance guides and the HR Connect banner screen to direct users to contact the HR Connect Help Desk to resolve system issues.

  • Established routine system communications with all HR Connect Separating Employee Clearance Record stakeholders in the Separating Employee Clearance process, Points of Contact, IT office, Facilities Management and Security Services, Privacy, Governmental Liaison, and Disclosure, and others.

  • Socialized new information and communicated changes to all Separating Employee Clearance users.

 

The IRS Human Capital Officer and IT office plans to collaborate to develop standard operating procedures to reconcile and resolve discrepancies between clearance module records and IT office computer inventory records. The standard operating procedures will be developed as a part of the Separating Employee Clearance Integrated Project Team implementation plan activities.
FOOTNOTES

 

 

1 Any yearly accounting period, regardless of its relationship to a calendar year. The Federal Government's fiscal year begins on October 1 and ends on September 30.

2 According to the Human Resources Reporting Center Population Report for FY 2014, the Internal Revenue Service had more than 90,000 employees, including seasonal employees.

3 Part of the Department of the Treasury's HR Connect system. HR Connect provides managers with the ability to access basic data for employees they supervise, initiate awards and other personnel actions, manage positions by reviewing detailed information about authorized staffing, and initiate recruitment actions.

4 Used to initiate and document employee events such as job reclassification, promotions, name changes, and retirements.

5 The office that establishes policies and procedures for the management and control of information technology equipment.

6 A permanent sticker with a unique series of lines printed on it, which is attached to an information technology asset for quick identification by a scanner.

7 The Knowledge Incident/Problem, Asset Management -- Asset Manager is used to track information technology and non-information technology equipment throughout the IRS.

8 Documentation showed that one laptop was reported stolen more than two months before the employee's separation; therefore, we did not consider the laptop as unrecovered when the employee separated.

9 The Separating Employee Clearance manager's handbook was revised in May 2015.

10 See Appendix I for our sampling methodology.

11 The point estimate projection is based on a two-sided 95 percent confidence interval. We are 95 percent confident that the point estimate is between 613 and 1,150. See Appendix IV.

12 When employees return an assigned laptop, the manager should enter "returned."

13 We relied on the IT office inventory records correctly identifying computers assigned to IRS employees. There is a risk that if the IT office inventory records were incorrect, that our results may also be incorrect for certain separated employees.

14 If a laptop is not assigned to the employee, the manager should enter a status of "not applicable."

15 When clearance module records are created, the manager should enter a status of "initiated."

16 A judgmental sample is nonstatistical and cannot be used to project to the population.

17 This list ranks standard IRS positions as high, moderate, and low mobility, and indicates whether a laptop would normally be assigned to the employee.

18 The sample was selected from 169 of the 4,106 separated employees in FY 2014 with a pending disciplinary case (including criminal misconduct) that were in job series for which laptops are generally assigned.

19 TIGTA, Ref. No. 2013-20-089, Weaknesses in Asset Management Controls Leave Information Technology Assets Vulnerable to Loss (Sept. 2013).

 

END OF FOOTNOTES

 

 

* * * * *

 

 

Appendix I

 

 

Detailed Objective, Scope, and Methodology

 

 

Our overall objective was to determine whether IRS management implemented policies and procedures designed to provide reasonable assurance that laptops are returned when employees separate from the IRS. To accomplish our objective, we:

I. Assessed whether controls were designed to provide reasonable assurance that laptops were recovered when employees separated from the IRS.

 

A. Reviewed the Internal Revenue Manual and held discussions with IRS management to identify controls for recovering laptops from separated employees.

B. Interviewed Agency-Wide Shared Services office management and reviewed documentation to determine how IRS management used the clearance module to record the recovery of laptops.

C. Interviewed IT office management and reviewed documentation to determine procedures the IT User Network Services office used to monitor whether managers returned laptops or recorded those that were unrecoverable.

D. Determined how the requirements for recovering laptops from separated employees were communicated to IRS management.

 

II. Determined whether designed controls were functioning and provided reasonable assurance that laptops were recovered when employees separated from the IRS.

 

A. Obtained a download of the Treasury Integrated Management Information System Separated Employee file and determined that the data were reliable for our purpose by validating that date fields contained dates, name fields contained names, etc., and by matching a sample of records to the HR Connect Separating Employees Clearance module (hereafter referred to as clearance module) records. We identified 4,158 full-time, permanent IRS employees, excluding Chief Counsel and Criminal Investigations employees,1 who separated during FY 2014.

B. Obtained a download of the HR Connect clearance module records for separated employees with information technology equipment fields. We determined the data were reliable for our purposes by validating that date fields contained dates, name fields contained names, etc., and that all equipment fields contained laptops. We determined that 4,106 of the 4,158 employees who separated in FY 2014 had a record of a laptop in the HR Connect clearance module records.2

C. Selected a stratified random sample of 149 of the 4,106 unique employees who had a record of a laptop in the HR Connect clearance module records.3 We used the following criteria: 90 percent confidence level, 50 percent or less expected error rate, and ±7 percent precision rate. The sample included three strata based on the number of separations occurring in each day: high (greater than 200 separations), medium (10-200 separations), and low (less than 10 separations).

D. Selected a judgmental sample4 of 28 of the 169 employees who separated under adverse conditions5 by matching the Social Security Numbers from the separated employees to the Automated Labor and Employee Relations Tracking System.6 We performed key word searches (i.e., criminal, drugs, fraud, theft, etc.) and identified 28 egregious, adverse separations.

E. Matched the 149 employees in the random sample and the 28 employees in the judgmental sample of adverse separations to the clearance module records. We determined if laptops were recovered and then compared clearance module documentation to IT office inventory records to verify return of the laptops.7

F. Selected a judgmental sample8 of 28 of the 41 separated employees who did not have a record of a laptop in the clearance module, for which other employees in their job series were issued a computer based on the IRS Standardized Profile Listing.9 We performed analysis of the IT office inventory records provided by IRS management to determine if computer inventory records indicated the employee was assigned a laptop prior to separation, and if the laptop was returned to inventory after the employee separated.

 

Internal controls methodology

Internal controls relate to management's plans, methods, and procedures used to meet their mission, goals, and objectives. Internal controls include the processes and procedures for planning, organizing, directing, and controlling program operations. They include the systems for measuring, reporting, and monitoring program performance. We determined that the following internal controls were relevant to our audit objective: IRS policies, procedures, and practices for retrieving laptops from separated employees. We evaluated these controls by reviewing clearance module records, IT office inventory records, and documentation supporting the retrieval of laptops, and interviewing management about actions taken when laptops were not returned for selected employees who separated during FY 2014.

 

FOOTNOTES TO APPENDIX I

 

 

1 Chief Counsel and Criminal Investigations were excluded because they use a different process for separating employees.

2 While reasonableness tests showed the data were sufficiently reliable, further testing showed that clearance module records were not always accurate. See Appendix IV.

3 A stratified random sample was selected to permit projection of the sample results. A contract statistician assisted with developing the sampling plans and projections.

4 A judgmental sample is a nonprobability sample, the results of which cannot be used to project to the population. A judgmental sample was selected because we did not intend to project the results.

5 Adverse conditions include a removal disposition code (i.e., probation/separation, termination for job abandonment, etc.) of an employee with a pending conduct or performance issue in the Automated Labor and Employee Relations Tracking System. Disposition codes 015, 016, 017, 018, 116, 117, and 118 were used to identify adverse separations.

6 The IRS Human Capital Office Workforce Relations system used to track employee behavior that generally may warrant disciplinary action by IRS management.

7 We performed validity checks to assess the reasonableness of the IT office inventory records and determined they were reliable for verifying whether managers recovered laptops and returned them to the IT office. Our testing did not include physical verification of the IT office inventory records.

8 A judgmental sample was selected because we did not intend to project the results.

9 This list ranks standard IRS positions as high, moderate, and low mobility, and indicates whether a laptop computer would normally be assigned to the employee.

 

END OF FOOTNOTES TO APPENDIX I

 

 

* * * * *

 

 

Appendix II

 

 

Major Contributors to This Report

 

 

Gregory D. Kutz, Assistant Inspector General for Audit (Management Services and Exempt Organizations)

Troy D. Paterson, Director

Gerald T. Hawkins, Audit Manager Julia Moore, Lead Auditor

Yolanda D. Brown-Alexander, Auditor

 

* * * * *

 

 

Appendix III

 

 

Report Distribution List

 

 

Commissioner

Office of the Commissioner -- Attn: Chief of Staff

Deputy Commissioner for Operations Support

Associate Chief Information Officer, User and Network Services

Director, Employee Support Services, Agency-Wide Shared Services

Director, Operation Service and Support

Director, Office of Audit Coordination

 

* * * * *

 

 

Appendix IV

 

 

Outcome Measures

 

 

This appendix presents detailed information on the measurable impact that our recommended corrective actions will have on tax administration. These benefits will be incorporated into our Semiannual Report to Congress.

Type and Value of Outcome Measure:

Reliability of Information -- Potential; 8821 employees with inaccurate clearance module records or IT office inventory records (see page 3).

Methodology Used to Measure the Reported Benefit:

We reviewed a statistically valid stratified sample of clearance module records for 149 of 4,106 full-time, permanent IRS employees with laptops who separated during FY 2014, excluding Chief Counsel and Criminal Investigations employees,2 and compared the records to third-party documentation (including IT office inventory records and additional documentation requested from IRS managers).

We determined that the third-party documentation was inconsistent with the information presented in the clearance module or IT office inventory records for 32 of the 149 employees.3 To estimate the total number of exceptions based on the sample error rate, we stratified the population into three strata and determined the percentage of population by strata. See Figure 1 for more details.

                                   Figure 1:

 

     Exception Summary by Category of Number of Daily Separations (Strata)

 

 ______________________________________________________________________________

 

 

                                                                     Estimated

 

 Number of Separations           Population        Exception         Number of

 

 Per Day                         by Category       Percentage        Exceptions

 

 ______________________________________________________________________________

 

 

 Low (<10 separations)                712              194              137

 

 Medium (10-200 separations)        2,961              215              637

 

 High (>200 separations)              433              25               108

 

 

 Total Exceptions                                                       882

 

 ______________________________________________________________________________

 

 

 Source: Statistical projection of the results of our analysis.

 

 

Type and Value of Outcome Measure:

Reliability of Information -- Actual; two employees with inaccurate IT office inventory records (see page 3).

Methodology Used to Measure the Reported Benefit:

We reviewed a judgmental sample of 28 of 41 separated employees who did not have a record of a laptop in the clearance module for which other employees in their job series were issued a laptop based on the IRS Standardized Profile Listing.6 We reviewed IT office inventory records to determine whether the employees were assigned a computer prior to their separation, and if the computers were returned to inventory after the employees separated. We determined that two of the 28 employees were assigned laptops that were returned, but one was not updated in IT office inventory records, and the other laptop was never assigned to the employee in IT office inventory records.

 

FOOTNOTES TO APPENDIX IV

 

 

1 The point estimate projection is based on a two-sided 95 percent confidence interval. We are 95 percent confident that the point estimate is between 613 and 1,150.

2 Chief Counsel and Criminal Investigations were excluded because they use a different process for separating employees.

3 We identified 30 clearance module input errors and three IT office inventory record errors. One of the three IT office inventory record errors was also a clearance module input error.

4 This percentage has been rounded from 19.23 percent.

5 The actual percentage used for this calculation was 21.5 percent and was not rounded up in this table.

6 This list ranks standard IRS positions as high, moderate, and low mobility, and indicates whether a laptop would normally be assigned to the employee.

 

END OF FOOTNOTES TO APPENDIX IV

 

 

* * * * *

 

 

Appendix V

 

 

Management's Response to the Draft Report

 

 

JUL 25 2016

 

 

MEMORANDUM FOR

 

MICHAEL E. MCKENNEY

 

DEPUTY INSPECTOR GENERAL FOR AUDIT

 

 

FROM:

 

Daniel T. Riordan

 

IRS Human Capital Officer

 

 

SUBJECT:

 

Draft Audit Report -- Improvements in Controls Are Needed

 

for Laptop Computers Recovered When Employees Separate

 

(Audit #201510024)

 

 

Thank you for the opportunity to respond to the subject draft audit report. We are committed to ensuring that Internal Revenue Service (IRS) policies and procedures provide reasonable assurance that laptop computers are returned when employees separate from the IRS.

We agree with both recommendations and will develop and implement Ihe corrective actions detailed in the attached response.

We have completed the following key initiatives to ensure timely and comprehensive completion of laptop controls when employees separate:

  • Updated the HR Connect Separating Employee Clearance Manager/Proxy Guide to include additional equipment for tracking information to select the appropriate return method,

  • Completed six training sessions to provide an overview of the HR Connect updates,

  • Socialized and communicated new information and changes to all SEC Users, and

  • Updated the HR Connect SEC guides and the HR Connect banner screen to have employees and managers contact the HR Connect Help Desk to resolve system issues

 

We have reviewed and concur with TIGTA's calculations of measurable benefits and believe that implementation of the attached corrective actions will address these benefits.

We appreciate the continued support and assistance provided by your office to address your recommendations. If you have any questions, please contact me at 202-317-7600. If there are technical questions, a member of your staff may contact Elise Hellmuth, Associate Director, Personnel Systems at 267-941-2521.

Attachment

 

* * * * *

 

 

Attachment

 

 

RECOMMENDATION 1:

The IRS Human Capital Officer should update separating employee clearance guidance to include instructions for selecting the appropriate status for laptops and provide training for managers on the updated procedures.

CORRECTIVE ACTION:

We agree with this recommendation. The IRS Human Capital Officer has:

  • Completed 5/18/2016 -- As requested by IT the HR Connect Separating Employee Clearance Manager/Proxy Guide was updated to include Desktop as an additional IT item for tracking purposes. In addition, Desktop, Printer, Blackberry/SmartPhone, and Wireless Air Card were updated to reflect that managers are required to comment on the items.

  • Completed 5/16/2016 -- Page 8 of the SEC Manager/Proxy User Guide reflects information for selecting the appropriate Estimated Return Method status for IT equipment including Not Applicable and Unrecoverable.

  • Completed six training sessions to provide an overview of the HR Connect updates which included changes to the IT items:

 

The IRS HCO and IT will provide additional HR Connect SEC Manager/Proxy User Guide updates. The updates will include additional clarification on the Return Status and Comments. HCO Personnel Systems will host HR Connect SEC Manager/Proxy training sessions to share the updated guidance.

IMPLEMENTATION DATE:

  • As of 06/16/2016, the completed items were resolved.

  • By 10/31/2016, the pending items will be resolved.

 

RESPONSIBLE OFFICIAL:

Director, Payroll/Personnel Systems Division, Human Capital Office

CORRECTIVE ACTION MONITORING PLAN:

HCO will enter accepted corrective actions into the Joint Audit Management Enterprise System (JAMES). These corrective actions are monitored on a monthly basis until completion.

RECOMMENDATION 2:

The IRS Human Capital Officer should work with IT office management to develop procedures to reconcile and resolve discrepancies between clearance module records and IT office inventory records when employees separate.

CORRECTIVE ACTION:

We agree with this recommendation. The IRS Human Capital Officer has:

  • Updated the HR Connect SEC guides and the HR Connect banner screen to direct users to contact the HR Connect Help Desk to resolve system issues.

  • Established routine system communications with all HR Connect SEC Record stakeholders in the SEC process, Points of Contact, IT, Facilities Management and Security Services, Privacy Governmental Liaison and Disclosure, and others, Socialized new information and communicated changes to all SEC Users.

 

The IRS HCO and IT will collaborate to develop standard operating procedures to reconcile and resolve discrepancies between clearance module records and KISAM's IT asset inventory records. The standard operating procedures will be developed as a part of the Separating Employee Clearance (SEC) IPT (integrated project team) implementation plan activities.

IMPLEMENTATION DATE:

  • By 08/01/2016, HCO will complete communications.

  • By 09/30/2017, IT will resolve the pending items.

 

RESPONSIBLE OFFICIAL:

Director, Payroll/Personnel Systems Division, Human Capital Office

CORRECTIVE ACTION MONITORING PLAN:

IT has anomaly reporting that serves as a Key Performance Indicator to how successful we are. The Invalid SEID reporting is monitored weekly to identify progress and trends. It identifies how much equipment is assigned to invalid SEIDs in our KISAM inventory database -- (it identifies what equipment remains assigned to employees who have fallen off the CADs database).

HCO will enter accepted corrective actions into the Joint Audit Management Enterprise System (JAMES). These corrective actions are monitored on a monthly basis until completion.

DOCUMENT ATTRIBUTES
  • Institutional Authors
    Treasury Inspector General for Tax Administration
  • Subject Area/Tax Topics
  • Jurisdictions
  • Language
    English
  • Tax Analysts Document Number
    Doc 2016-17442
  • Tax Analysts Electronic Citation
    2016 TNT 168-11
Copy RID