. As a result of a study, it was concluded that Examination had a need for a new information management system. The study group recommended a terminal assisted Audit Information Management System (AIMS). A stand alone direct access terminal system was considered along with the enhancement of IDRS. Enhancement of IDRS was determined to be clearly the best choice for the Service.

This new system satisfied Examination Division's current needs for accurate and timely inventory controls, better control of assessments and up-to-date management reports. The system traces examination results through final determination of tax liability including Appeals and Tax Court.

After the successful implementation of AIMS for the Examination Division, control of returns in Appeals was added to AIMS. As of January 1, 1977 control of Exempt Organization returns was added and on October 1, 1977 control of Employee Plan returns was added.

During the summer of 1973, the Deputy Commissioner established a Task Force to identify ADP requirements of Compliance functions, and to make appropriate recommendations to satisfy their needs.

Headquarters AIMS Related Section is responsible for maintaining procedures related to AIMS programming.

IRS implements access control measures that provide protection from unauthorized alteration, loss, unavailability, or disclosure of information.

SACS controls all the IDRS user accesses and permissions.

The following table defines acronyms frequently used throughout this IRM section:

EOD, IMF, BMF, EPMF, NMF, RCCMS, RGS

The greatest potential for unauthorized disclosure of tax information occurs when IDRS user employees handle telephone inquiries from taxpayers. Employees should exercise special precautions to identify the taxpayer or his/her authorized representative when answering such inquiries. In responding to telephone inquiries, no tax return information may be given out unless it relates to a notice, billing, letter initiated by the IRS, or refund inquiry.

When responding to telephone inquiries about a tax account, the employee handling the inquiry should, at a minimum, obtain the taxpayer's name, address and taxpayer identification number (SSN or EIN). Recipients of calls should continue to ask enough questions to satisfy themselves that they are speaking to the taxpayer. The following are types of information that might be asked the caller:

If a caller is unable to furnish enough information to establish that he/she actually is the taxpayer, the employee should request that the caller find out the information and call back. If the caller states he/she does not have the information and cannot obtain it, the employee should advise the caller that a written reply will be mailed to the taxpayer's address of record.

Employees should not provide Taxpayer Identification Numbers over the telephone.

Walk-in taxpayers should not be given tax return information until they have properly identified themselves.

Information concerning taxpayers will not be provided to third parties without written authorization from the taxpayer. For example, specific information concerning a client's bill or notice will not be provided to third parties without receipt of written authorization from the taxpayer. This is true even though the third party requesting information has possession of a copy of the bill or notice in question.

Written authorization from the taxpayer is not restricted to a power of attorney or to any specific form. The authorization must bear the taxpayer's signature. Taxpayer Service employees will not request returns from campuses or Federal Records Center solely for verification of the taxpayer's signature. If there is serious doubt whether the signature on the authorization is the taxpayer's, offer to mail the information to the taxpayer's address of record.

In walk-in contacts, if the third party has possession of a copy of the bill or notice in question, the written authorization should bear the taxpayer's signature and give some indication that the third party is authorized to act for the taxpayer. In the absence of such a written authorization, the third party may only be furnished general information regarding the meaning of the bill or notice. If the third party does not have possession of a bill or notice, the written authorization should bear the taxpayer's name, address and signature and contain information peculiar to the taxpayer of which the third party would not generally be aware. For instance, if the letter or authorization describes a specific refund problem or inquiry with specific facts that only the taxpayer should be aware of, the third party may be given information regarding the refund.

In telephone contacts, Taxpayer Service personnel are restricted to the information they may furnish third parties in the absence of written authorization. Only general information regarding the meaning of a particular notice or letter may be given. Advise the third party to furnish a written authorization in order that information may be provided, or offer to call the taxpayer or mail information to the taxpayer's address of record. Otherwise, no specific information related to the taxpayer or his/her account may be given. No information from IDRS, microfilm, or tax returns may be given to the third party. Naturally, information the third party offers may be accepted. For example, canceled check information may be accepted to initiate a payment tracer on a bill but no information relative to the balance due or nature of the assessment may be given.

When a third party makes a written inquiry, no information may be furnished without written authorization from the taxpayer.

It should be kept in mind that relatives are third parties and the rules outlined in this section apply to them. These rules do not apply to husband and wife when both sign a joint return. However, when a spouse has been claimed as a dependent on a return (instead of filing jointly) the dependent spouse may not be given information without written authorization from the taxpayer who signed the return.

It is essential that only properly authorized employees have access to command codes since IDRS terminals can be used to change taxpayers' accounts. It is equally important that each employee be protected from other personnel using his/her identification since the only record of the employee making the change will be computer generated from the entry code input by the operator. Proper use of Command Codes SINON and SINOF will provide necessary protection to the employee. However, an employee must properly safeguard his/her password in order to obtain the benefits of the system.

Each IDRS user will be given a password and he/she is responsible for its security.

Any time a password is compromised, or even if an employee suspects that it has been, he/she will notify the system Security Supervisor to obtain another password. An employee must request a new password if he/she forgets his/her current password.

An employee must sign on IDRS before accessing or changing any account on IDRS. The employee will accomplish this by inputting Command Code CC) SINON (see Exhibit 2.8.1–1) that will verify whether or not the employee is authorized to use IDRS.

Immediately prior to signing on, the employee will press any key to determine if the "real-time" system and the terminal are operational. If the real-time happens to go down in the service center before completely inputting CC SINON, the employee should back space through the input. This will clear the sign-on data from the screen. Upon receiving notification that the system is available again, he/she may re-enter CC SINON.

To sign on a terminal the employee will depress (F1). This generates the SINON format with the Production Training Indicator (PTI) which will be P. Next, the Social Security Number (can also use SEID to SINON vs. SSN) and then the name data are input. The password is the last item input before pushing the XMIT key. To protect a password, the employee will tab the cursor to right of the indicator present on the screen.

Employees must use CC SINOF (see Exhibit 2.8.1–2) whenever they are going to be away from the terminal (for example, going to lunch, break, or back to desk). Employees should stay signed on only when they are actively using the terminal or when they can see the terminal and anticipate using it again soon.

Proper use of Command Code SINOF provides employees complete security. If an employee does not SINOF, there is always a danger that someone else will use his/her terminal during his/her absence, and all the actions on the terminal will be recorded as being done by the original employee.

If a user is signed on at a terminal and signs on at another terminal, the original terminal will automatically be deactivated.

In the EPSF there will be two profiles recorded, a production profile and a training profile. The production or training indicator in CC SINON determines which profile is used. While operating in the training mode on production accounts, no actual updating of any IDRS data can be made. ALL command codes will be used in exactly the same manner as when in production mode.

Trainees will be able to update a training account through real-time and then be able to recall the account to view the updated affect. Accounts may be restored to the original condition by two methods:

When an IDRS user is signed on in the Training Mode, the terminal will be authorized the same command codes as the user's training profile until he/she signs off.

Employees should always clear the screen when the terminal operation is completed.

Employees should be sure to retrieve all prints if the terminal is connected to a printer. If someone leaves a print in the printer, it should be placed in classified waste if the originator cannot be determined.

IDRS terminals are programmed for real-time usage and are systematically deactivated at the end of each work day. Any input at a time not during the authorized time period will be recorded as a security violation.