30.09.2014 Views

PDF - Department of the Treasury

PDF - Department of the Treasury

PDF - Department of the Treasury

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

TIGTA reviewed. In addition,<br />

documentation required in <strong>the</strong> development<br />

phase provided only general or outdated<br />

descriptions <strong>of</strong> security requirements and<br />

controls. Because many <strong>of</strong> its core systems<br />

are being rebuilt, security controls should<br />

be provided during <strong>the</strong> development phase<br />

and tested during <strong>the</strong> integration phase <strong>of</strong><br />

modernization projects.<br />

Waiting until after implementation to<br />

address security weaknesses will most<br />

likely cost significantly more and could<br />

result in system exploitation by<br />

unauthorized individuals or personnel. The<br />

lack <strong>of</strong> disaster recovery planning in <strong>the</strong><br />

development phase could unnecessarily<br />

prolong <strong>the</strong> recovery from a natural disaster<br />

or terrorist attack. TIGTA believes <strong>the</strong><br />

PRIME contractor focused on delivering<br />

systems that would function, but did not<br />

provide enough emphasis on security<br />

controls. In addition, <strong>the</strong> IRS was not<br />

sufficiently involved in <strong>the</strong> early<br />

development stages <strong>of</strong> <strong>the</strong> systems to<br />

ensure that <strong>the</strong> PRIME contractor<br />

developed security controls in compliance<br />

with IRS standards.<br />

TIGTA recommended that <strong>the</strong> IRS ensure<br />

coordination between it and <strong>the</strong> PRIME<br />

contractor and revise guidance to require<br />

disaster recovery planning in <strong>the</strong><br />

development phase <strong>of</strong> <strong>the</strong> system life cycle.<br />

The IRS should also ensure that audit trail<br />

data are retained and reviewed to detect<br />

unauthorized accesses. The IRS agreed<br />

with most <strong>of</strong> <strong>the</strong> recommendations and is<br />

taking action to address <strong>the</strong> conditions.<br />

Report Reference No. 2005-20-128<br />

The Customer Account Data Engine<br />

(CADE) is a critical building block in <strong>the</strong><br />

IRS’ modernization program. It will enable<br />

<strong>the</strong> development <strong>of</strong> subsequent modernized<br />

systems to improve customer service and<br />

compliance. The CADE will be<br />

implemented in a series <strong>of</strong> releases over<br />

several years, while, concurrently, <strong>the</strong> older<br />

Master File system will be phased out.<br />

Tax Year (TY) 2004 return information was<br />

accurately and timely posted to CADE<br />

accounts. The IRS issued accurate refunds<br />

faster for those returns posted to <strong>the</strong> CADE<br />

than those posted to <strong>the</strong> Master File. The<br />

IRS also provided accurate refund<br />

information on <strong>the</strong>se returns through its<br />

automated telephone service and its Web<br />

site. When tax returns did not meet CADE<br />

criteria, <strong>the</strong> account information was<br />

accurately transferred to <strong>the</strong> Master File.<br />

However, TIGTA identified employee<br />

actions that, coupled with CADE<br />

restrictions, caused accounts to be<br />

unnecessarily moved from <strong>the</strong> CADE to <strong>the</strong><br />

Master File. The IRS immediately issued<br />

instructions to minimize <strong>the</strong>se actions.<br />

The successful implementation <strong>of</strong> <strong>the</strong> first<br />

two CADE releases is a noteworthy<br />

achievement, which includes accurate<br />

account postings, automated telephone and<br />

Web site service, and faster refunds. There<br />

is much to be done, however, and<br />

expanding <strong>the</strong> CADE will become more<br />

challenging as <strong>the</strong> IRS adds capabilities to<br />

handle more complex tax returns.<br />

Report Reference No. 2005-40-109<br />

TIGTA reviewed four business cases for<br />

Budget Years (BY) 2005 and 2006 and<br />

noted that all four business cases contained<br />

deficiencies; none <strong>of</strong> <strong>the</strong> four were in<br />

compliance with Office <strong>of</strong> Management and<br />

April 1, 2005 to September 30, 2005 9

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!