TIGTA Examines IRS Progress on ACA Case Management System

IMPACT ON TAXPAYERS

The Affordable Care Act (ACA) includes provisions that impose penalties, administered through the tax code, for businesses that do not obtain health coverage for their employees. Starting in the 2015 Filing Season, employers with 50 full-time employees, or a combination of full-time and part-time employees that is equivalent to 50 full-time employees, are subject to the Employer Shared Responsibility Payment provisions. The IRS will provide the ACA Case Management-Case Management (ACM) system that allows IRS employees to create, manage, and track the status of Employer Shared Responsibility Payment compliance cases to ensure employer compliance.

WHY TIGTA DID THE AUDIT

The overall objective was to determine whether the ACM Project Management Office adequately managed risks that may delay the ACM system from being deployed in January 2017.

WHAT TIGTA FOUND

The IRS currently maintains approximately 90 separate case management systems. Case management is the process that addresses the resolution of tax administration issues through the management of case creation, execution, maintenance, and closure. Entellitrak is the IRS's Enterprise Case Management tool. An analysis of Entellitrak determined that it appears to meet the case management needs of the ACM system. The IRS identified 77 ACM capabilities and determined that 35 are available in the Enterprise Case Management System. The remaining 42 capabilities are unique to the ACM system and were planned to be developed by the ACM project.

In addition, the IRS implemented a change management process to ensure that the ACM system aligns with the Enterprise Case Management system requirements. The change management process involves determining the type of request being made to change an IRS information technology system, which in turn determines the path used to decide whether the change will be approved.

Also, the ACM team monitored potential risk involving interfacing systems. One interfacing system may not be completed by January 2017. ACM management had several discussions on this risk. ACM management planned to continue monitoring the risk in view of the pending decisions for ACA 7.1 release scope.

At the end of the audit, TIGTA obtained documentation that shows the Information Technology ACA Program Governance Board approved, on June 7, 2016, a request to close the ACM project and transfer its functional components and documentation to the Enterprise Case Management Program Management Office.

WHAT TIGTA RECOMMENDED

TIGTA made no recommendations in this report. IRS officials reviewed the report and agreed with the facts presented.

IRS management reviewed the draft report and agreed with the facts presented. Because we made no recommendations in the report, IRS management agreed to the final report being issued without a management response.

Copies of this report are being sent to the IRS managers affected by the report. If you have any questions, please contact me or Danny Verneuille, Acting Assistant Inspector General for Audit (Security and Information Technology Services).

                           Table of Contents

• Provide more Americans with access to affordable health care by creating new Health Insurance Exchanges.

• Enforce patient/consumer protections.

• Provide government subsidies for people who cannot afford insurance.

In June 2010, the IRS established the Information Technology (IT) ACA Program Management Office (PMO) to ensure a dedicated focus on fulfilling the ACA requirements. Specifically, the ACA PMO is responsible for planning and managing information technology responsibilities related to ACA implementation and the myriad of legislative requirements. The ACA PMO developed a multi-year release² strategy to support information technology development. Some of these releases are in production, while others are in various stages of development and are scheduled for implementation over the next several years.

ACA Release 7.1 includes a new ACA system called the ACA Case Management-Case Management Release 1.0 system (referred to as the ACM system) and focuses on the post-filing compliance activities for ACA Section 1513 -- Internal Revenue Code Section 4980H(a) [hereafter referred to as Section 4980H(a)] regarding an employer's shared responsibilities for providing health care coverage.

Starting in the 2015 Filing Season, an employer with 50 full-time employees or a combination of full-time and part-time employees that is equivalent to 50 full-time employees is referred to as an Applicable Large Employer (ALE) and will be subject to the Employer Shared Responsibility Payment (ESRP) provisions. Under the ESRP provisions, if an ALE does not offer affordable health coverage that provides a minimum level of coverage to its full-time employees (and their dependents), the ALE may be subject to an ESRP if at least one of its full-time employees receives a premium tax credit. To comply with the ESRP provision, all ALEs are required to file Form 1094-C, Transmittal of Employer-Provided Health Insurance Offer and Coverage Information Returns, and Form 1095-C, Employer-Provided Health Insurance Offer and Coverage. Form 1094-C must be used to report to the IRS summary information for each employer and to transmit Forms 1095-C to the IRS. Form 1095-C is used to report information about each employee. Forms 1094-C and 1095-C are used in determining whether an employer owes a payment under the Section 4980H(a) ESRP provisions.

Under Section 4980H(a), the IRS is responsible for the following post-filing compliance activities:

• Performing analytical activities using information returns, Exchange Periodic Data, and tax returns data in order to identify Section 4980H(a) ESRP compliance cases and issue a Preliminary Letter to potentially noncompliant ALEs. As defined by the statute, a full-time employee is an individual averaging at least 30 hours of service per week.

• Handling employer responses to the Preliminary Letter and adjusting Section 4980H(a) ESRP amounts as necessary. The IRS will issue a Notice and Demand for payment to employers who have been assessed an ESRP and create a collections treatment stream for unpaid Section 4980H(a) assessments.

The ACM system will use Entellitrak, a commercial off-the-shelf (COTS) case management product, to provide a new case management system that allows IRS employees to create, manage, and track the status of Section 4980H(a) ESRP cases to ensure employer compliance.

The ACM system will also allow ALEs to modify a subset of their previously provided employee information before being assessed a final ESRP amount. The ACM system will receive Section 4980H(a) case data from the ACA Compliance Validation Correlation process. The Section 4980H(a) cases will open when the ACM system receives the data and will close when either a Notice and Demand or a Closing Letter are initiated.

IRS employees will be able to access post-filing compliance data in the ACM system through a web application interface. The ACM system will also interface with existing legacy systems in order to generate various correspondences (e.g., a Preliminary Letter) and log transactions in the Business Master File. The ACM system will store electronic copies of correspondence sent to the ALE, store scanned images of an employer's response to the Preliminary Letter, allow an IRS employee to enter and evaluate the ALE's response, and recalculate the ESRP. The result of the ACM process will be the issuance of a preliminary finding, capture of an ALE response, assessment of the response, determination of a final ESRP penalty amount, and issuance of a Notice and Demand or Closing Letter.

On January 13, 2015, approximately one month after the ACM project began the Project Initiation/Domain Architecture Phase (Milestone 1/2),³ the IRS Commissioner approved the approach for creating an Enterprise Case Management (ECM) system that can be applied throughout the entire IRS, and the IRS also began to establish the ECM PMO. On June 3, 2015, IRS leadership approved the inclusion of the individual ACM system and Return Review Program into the overall ECM program. Figure 1 is a chronology of the development of the ACM system and the ECM program.

   Figure 1: Chronology of the ACM System and ECM Program Development

At the end of this review, TIGTA obtained documentation that shows the IRS decided to close the ACM project. The IRS established a Digital Subcommittee to focus on strategies for creating and prioritizing digital solutions for taxpayer services. The ACA PMO briefing to the Chief Technology Officer dated April 1, 2016, stated that the Digital Subcommittee completed a Risk Acceptance Form and Tool to document an approach to find savings by delaying or stopping work on certain information technology projects in order to free up resources that can be used to: 1) further digital efforts; 2) reduce the overall IRS/information technology budget deficit; and 3) ensure strategic administrative programs were resourced and funded. Because of the Risk Acceptance Form and Tool, the Chief Technology Officer and Deputy Chief Information Officer directed that, effective immediately, the IT organization was to "stop work, de-scope efforts, and begin an orderly and rapid shutdown" on the specified projects. As a result, on June 7, 2016, the IT ACA Program Governance Board approved a request to close ACM Project Release 1.0. The ACM functional components and documentation will be transferred to the ECM PMO. Any future scope for a systemic solution for the ACM system or a developed ACM application will require disposition by the ECM PMO Governance Board.

This review was performed at the ACM office in Farmers Branch, Texas, and the ECM office at the New Carrollton Federal Office Building in Lanham, Maryland, during the period December 2015 through June 2016. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objective. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective. Detailed information on our audit objective, scope, and methodology is presented in Appendix I. Major contributors to the report are listed in Appendix II.

Internal Revenue Manual 2.16.1, Enterprise Life Cycle Guidance, provides system development guidelines including project management procedures. A project may employ the use of the following investigative components to analyze a project's feasibility, functionality, and performance prior to its full deployment: prototypes, technical demonstrations, proof-of-concepts (POC), or pilots. A POC is used to demonstrate the feasibility of an idea or to prove a theory to mitigate integration, interoperability, or system-level risks.

In May 2013, the IRS assembled a team with representatives from the Small Business/Self-Employed Division and IRS IT organization personnel from the Solution Engineering, Enterprise Architecture, Internal Management, and Applications Development functions. The team was tasked with evaluating COTS products that could be used as a framework for an ECM platform. An initial list of six products was compiled based on products recommended by MITRE, Gartner, and Forrester⁴ and the IRS's experience with these products. In June 2013, the IRS completed its evaluation of the six products, resulting in a recommendation to use Entellitrak as the ECM tool. Results of this analysis were presented to IRS executives for approval and submitted to the Enterprise Architecture function for inclusion in the Enterprise Standards Profile.

The IRS conducted a POC from January to March 2015 to understand how to integrate the Entellitrak COTS product for the ACM system. For the POC, the IRS implemented an ACM data model in Entellitrak that incorporated ECM characteristics. Stated goals of the POC included providing the ACM system developers exposure to the Entellitrak development process through testing of the framework, validating that the targeted Entellitrak modules support the business requirements, identifying Entellitrak limitations, and establishing design and development guidelines and principles. At the conclusion of the POC, members of the ACM project team met to evaluate the POC and document lessons learned.

In April 2015, the IRS published documentation containing the POC results. The POC results document highlighted several technical accomplishments including implementation of a realistic ACM data model in Entellitrak and the ability to create and change case status and perform custom screen development. It also outlined a timeline for development and benefits of the product. At the July 2015 kick-off meeting for the ACM project, it was noted that Entellitrak was to be used as the product to develop the case management system. Based on our review of POC documents, we believe the POC was sufficient to determine that Entellitrak would meet the needs of the ACM project.

The Internal Revenue Service Identified Affordable Care Act Case Management Capabilities That Are Available in the Enterprise Case Management System

Internal Revenue Manual 2.16.1, states that project management involves planning, execution, monitoring and controlling, and deployment of a project to the Operations and Maintenance Phase. The approval to incorporate the ACM system into the ECM program requires having ACA Release 7.1, which includes the ACM project, align with the ECM architecture requirements.

In June 2015, IRS leadership determined that the ACM system and Return Review Program case management would be the first projects to use the new ECM system. In July 2015, a team was formed to identify overlapping requirements/capabilities between the ACM and the ECM systems. The team used a Rapid Delivery architecture approach to mitigate the concern that the ACM system development would get too far ahead of the ECM system's development. The August 17, 2015, ECM briefing document to the Chief Technology Officer reported that there were 138 ECM capabilities and 77 ACM capabilities and that 61 of the 77 ACM capabilities were mapped to 32 ECM capabilities.

We reviewed the latest mapping documents and confirmed that the mapped capabilities include capabilities for creating and managing Section 4980H(a) cases. However, only 35 (45 percent) of the 77 ACM capabilities were mapped to ECM capabilities. ACM management explained that the initial mapping identified some capabilities that needed further research to confirm that they could be mapped to ECM capabilities. After the additional research was performed, they determined that as of April 13, 2016, 35 (45 percent) of the 77 ACM capabilities remain mapped to ECM capabilities, and the remaining 42 (55 percent) are unique to the ACM system and were planned to be developed by the ACM project.

In the August 2015 briefing to the Chief Technology Officer, the ECM PMO stated that for a successful delivery, the ECM PMO must work with the ACM PMO to establish the first iteration of the ECM solution architecture by September 11, 2015, that ties in the existing ACA 7.1 solution architecture. On September 11, 2015, the ACM PMO received the first iteration of the ECM solution architecture for review. The review resulted in a change request to align the create case and update case functionalities in the ACM solution architecture with the ECM solution architecture.

The Internal Revenue Service Implemented a Process to Ensure That the Affordable Care Act Case Management System Aligns With the Enterprise Case Management Requirements

Internal Revenue Manual 2.16.1, states that project management involves orderly planning, execution, monitoring and controlling, and deployment of a project to the Operations and Maintenance Phase. The approval to incorporate the ACM system into the ECM program requires having ACA Release 7.1, which includes the ACM system align with the ECM architecture requirements.

The ACM project started the Project Initiation/Domain Architecture Phase (Milestone 1/2) in December 2014 and exited it in August 2015. The ACM 1.0 Business System Report Addendum Version 1.0, dated September 8, 2015, describes the system overview, initial requirements, and solution concept for the ACM system. It also specifies the overall objectives, scope, project requirements, business, system, infrastructure, application, data and security architecture concepts, nonfunctional and development considerations, release roadmap, and release plan for the ACM system. It is a project-level addendum to the ACA 7.1 Program Business System Report and is required to be completed to exit ACA 7.1 Milestone 2.

In June 2015, the IRS officially decided to include ACM and Return Review Program case management in the ECM program. By August 2015, the ECM program only had a conceptual solution architecture. On September 23, 2015, the ACM project manager informed us that the completed ACM Business System Report Addendum dated September 8, 2015, does not include ECM requirements because they were not available. We confirmed this information in an August 17, 2015, ECM presentation to the Chief Technology Officer which stated that the "ACM has already completed a Business System Report to capture its solution architecture . . ." and that on September 11, 2015, the ECM PMO was in the process of finalizing its first iteration of the ECM Solution Architecture. As a result, ECM-related changes to the ACM system will be made through the ACA Integrated Change Management Process. This change management process involves determining the type of request being made to change an IRS information technology system, which in turn determines the path used to determine whether the change will be approved.

The ECM high-level development timeline stated that the first version of the ECM Solution Architecture for three high-level capabilities was scheduled to be completed in September 2015. There was no due date for the version of the ECM Solution Architecture that would include the remaining ECM capabilities. The schedule stated that the ECM Solution Architecture would evolve gradually over time. We determined that delaying the ACM system until the ECM Solution Architecture was completed was not an option because the ACM system is scheduled to be deployed in January 2017. Therefore, the ACA Integrated Change Management Process is a practical way to update the ACM Solution Architecture to bring it into compliance with ECM requirements.

As of February 19, 2016, only one change request had been submitted and approved to align the ACM system with the ECM program. However, the ACA Program Change Control Board subsequently determined that, due to insufficient staffing, the ACM system can no longer accept additional ECM-related change requests without jeopardizing the January 2017 deployment date. As a result, on February 17, 2016, a change request moratorium was implemented to limit further ECM change requests affecting the ACM system. If other change requests had come in, they would have replaced previous items or delayed the implementation.

The Affordable Care Act Case Management Team Monitored a Potential Risk Involving Interfacing Systems

Internal Revenue Manual 2.16.1, states that the purpose of the Project Management Plan is to provide a framework for managing project activities and for completing the project successfully. It comprises subsidiary plans, including a Risk Management Plan and a Contingency Management Plan. It is a requirement for all IRS information technology projects and is a key project planning artifact.

The ACM Risk Management Plan states that the ACM project manager is responsible for: providing direction to the project team on the risk management process and tools, managing risks and issues for the project, and refining the mitigation/management plans and escalating them as necessary. This includes meeting and coordinating with IRS and other ACA system programs that need to be in place and functioning to ensure the timely deployment of the ACM system in January 2017. In addition, the ACM Risk Management Plan outlines the process for risk identification, analysis, mitigation, documentation, and escalation/elevation. It identifies the criteria for when a risk becomes an issue. If a risk has been realized or its probability of occurrence reaches 100 percent, indicating that the event is guaranteed to occur or that the risk has been realized, the risk may be elevated to an issue. Once confirmed that the risk should be elevated to an issue, the risk will be closed and opened as an issue in the risk management tracking system, Item Tracking Reporting and Control.

The ACM Contingency Management Plan provides guidance regarding the management of any impact that would result in the ACM project not meeting the operational dates as dictated by the ACA PMO. It states that impacts on the project itself, other projects, organizations, external trading partners, and stakeholders will be considered in the event that the deployment target date is not met.

We identified seven systems interfacing with the ACM system. The ACM project manager explained the procedures for coordination of the multiple systems needed to facilitate the operation and implementation of the ACM system. The project manager monitored risk through weekly and ad hoc meetings with the designated contacts to discuss and resolve any issues and to ensure that all projects are still meeting their established goals and expected completion dates. Based on these meetings, the ACM project manager logged risks and issues in the ACM project's risk and issue reports. The project manager incorporated the risks and issues into a weekly status report. These reports document the status of work completed and any issues identified as well as the progress and any solutions, actual or proposed. These reports were presented to the ACA PMO weekly and used to present issues and results up the management chain.

Between February and March 2016, we conducted meetings with six of the seven systems' contacts to determine if they understood the risk management and escalation process and if they identified and reported any issues that might affect the January 2017 ACM system implementation date. Of the six contacts with whom we met, only one, the Service Center Recognition Image Processing System contact, raised a potential issue. In December 2015, the following potential issue was reported by the ACM project manager: "If the Service Center Recognition Image Processing System team slips development of scanning ALE responses by six months (August 2016), then ACM's ability to receive and store scanned-in correspondence will be impacted." In February 2016, the ACM project manager submitted the risk into the risk management tracking system, Item Tracking Reporting and Control. ACM management had several discussions on this risk. The ACM project manager planned to continue monitoring the risk in view of the pending decisions for ACA 7.1 release scope.

² See Appendix V for a glossary of terms.

³ See Appendix IV for a description of the Enterprise Life Cycle phases.

⁴ MITRE, Gartner, and Forrester are leading research companies that provide information technology advice to their clients.

I. Evaluated the process used to determine whether the Entellitrak product will meet the needs of the ACM system.

Internal controls relate to management's plans, methods, and procedures used to meet their mission, goals, and objectives. Internal controls include the processes and procedures for planning, organizing, directing, and controlling program operations. They include the systems for measuring, reporting, and monitoring program performance. We determined that the following internal controls were relevant to our audit objective: policies and procedures for system development, project management, monitoring and mitigating system development risks, and status reports. We evaluated these controls by interviewing Applications Development and ECM management involved in the development of the ACM and ECM systems. We reviewed the ACM Contingency Management and Risk Management Plans, related status and risk reports, and appropriate Internal Revenue Manuals.

Myron Gulley, Acting Director

Michael Mohrman, Acting Audit Manager

Tina Wong, Lead Auditor

Mildred Rita Woody, Senior Auditor

Office of the Commissioner -- Attn: Chief of Staff

Deputy Commissioner for Operations Support

Deputy Commissioner for Services and Enforcement

Associate Chief Information Officer, Applications Development

Associate Chief Information Officer, Enterprise Program Management Office

Associate Chief Information Officer, Enterprise Services

Deputy Director, Enterprise Architecture

Director, Affordable Care Act

Director, Core Application Systems ACA

Director, Enterprise Case Management

Director, Infrastructure Compliance ACA

Director, Office of Audit Coordination

                     Figure 1: Enterprise Life Cycle Phases

The ACM project follows the COTS path. The COTS path has defined requirements, sequential progression through the phases, and evolving teams. It uses a vendor solution for its technical approach. The COTS path is used when prepackaged, vendor-supplied software will be used with little or no modification to provide all or part of the solution. The COTS path normally combines the Preliminary Design Phase and the Detailed Design Phase into the Design Phase. However, it can be modified through tailoring. The Enterprise Life Cycle phases for the COTS path for the ACM project were combined as follows:

• Project Initiation & Domain Architecture Phases (Milestone 1/2).

• Preliminary & Detailed Design Phase (Milestone 3/4a/4b).

• System Deployment Phase (Milestone 5).

The comprehensive health care reform law enacted in March 2010 and subsequently amended. The law was enacted in two parts. The Patient Protection and Affordable Care Act¹ was signed into law on March 23, 2010, and was amended by the Health Care and Education Reconciliation Act on March 30, 2010. The ACA refers to the final, amended version of the law.

ACA Compliance Validation Project

This project will perform data correlation between ACA third-party information and tax returns to support post-filing compliance. The results of the data correlation will eventually assist in case selection.

ACA Integrated Change Management Process

The process for handling IRS ACA change requests, unified work requests, and defects. Change requests and unified work requests are two existing information technology product/service request types that manage requests to change IRS information technology systems. Both request types are used across the IRS IT organization.

Business Master File

The IRS database that consists of Federal tax-related transactions and accounts for businesses. These include employment taxes, income taxes on businesses, and excise taxes.

Business System Report

A report that describes the system overview, initial requirements, and solution concept for a system development project.

Contingency Management Plan

This plan describes the approach that will be employed in the event the project cannot make the "operational readiness" date.

Enterprise Life Cycle

Establishes a set of repeatable processes and a system of reviews, checkpoints, and milestones that reduce the risks of system development and ensure alignment with the overall business strategy.

Enterprise Standards Profile

The authoritative repository for IRS approved products and standards. The Enterprise Standards Profile allows project owners and other stakeholders to select pre-approved technology products and standards. Development teams should determine which standards and approved products apply to their areas of responsibility. Listings in the Enterprise Standards Profile include guidance for usage that should be reviewed for useful relevant information.

Exchange

A new transparent and competitive insurance exchange where individuals and small businesses can buy affordable and qualified health benefit plans. Exchanges will offer a choice of health plans that meet certain benefits and cost standards.

Exchange Periodic Data

Information that each Exchange is required to provide to the IRS on a monthly basis regarding individuals who are enrolled by the Exchange.

Issue

A situation or condition that either (1) currently has negative consequences for the program/project or (2) has a 100 percent probability of having negative consequences for the program/project.

Item Tracking Reporting and Control

System used to track and report on issues, risks, and action items.

Milestone

Milestones provide for "go/no-go" decision points in a project and are sometimes associated with funding approval to proceed.

Mitigation Plan

A plan that specifies a set of activities that avoids the risk or controls the effects of the risk.

Premium Tax Credit

A refundable tax credit to help taxpayers and families afford health insurance coverage purchased through an Exchange.

Release

A specific edition of software.

Rapid Delivery

A collection of various software development and delivery techniques, tools, and approaches (collectively called treatments) that increase delivery velocity, quality, and job satisfaction while reducing cost and risk. It is intended to evolve over time, adopting new treatments as skills increase and opportunities are identified.

Requirement

A requirement is a formalization of a need and is the statement of a capability or condition that a system, subsystem, or system component must have or meet to satisfy a contract, standard, or specification.

Risk

An uncertain event or condition that, if it occurs, has a negative effect on the project.

Risk Acceptance Form and Tool

Used in an organization's approval processes to clearly document business decisions in the context of risk and acceptance.

Risk Management Plan

Describes the processes, techniques, and tools that will be used to track, manage, and control project risks.

Roadmap

The Information Technology Roadmap maps and aligns the business capabilities with the implementation of information technology systems that enable them. It consists of the program, capability, and project views.