The CFO Act of 1990, expanded by the Government Management Reform Act of 1994, authorizes the Government Accountability Office (GAO) to audit the IRS financial statements annually to determine whether (1) the financial statements are fairly presented and (2) IRS management maintained effective internal control over financial reporting. GAO also tests IRS’s compliance with selected provisions of applicable laws, regulations, contracts and grant agreements. The IRS’s FY 1992 financial statements were the first to be audited by GAO.

The IRS financial statement audit has implications beyond the IRS. The IRS’s financial statements roll up to the Department of the Treasury (Treasury) financial statements and Treasury's financial statements roll up to the governmentwide consolidated financial statements. An unfavorable audit opinion on the IRS financial statements impairs GAO's ability to rely on the Treasury and governmentwide financial statements to render an unmodified audit opinion for the federal government.

The GAO also reports annually on the status of new internal financial management audit (FMA) and/or information security (IS) control weaknesses and/or deficiencies identified during its audit of the financial statements and provides updates on IRS efforts toward previously reported GAO recommendations in the (1) management report and (2) information security reports (Public and Limited Official Use (LOU)).

Obtaining an unmodified audit opinion shows Congress and the public that the IRS is a good steward of public funds. An unmodified audit opinion also provides assurance that the IRS effectively plans and executes its strategic priorities (for example, to empower and enable all taxpayers to meet their tax obligations and protect the integrity of the tax system by encouraging compliance through administering and enforcing the tax code).

The authorities for this IRM include:

This section provides responsibilities for:

The program reports and tools used to manage the audit process are:

Program effectiveness is measured by:

The following controls are in place to ensure compliance with the financial statement audit program:

The following terms and definitions apply to this program:

The following acronyms apply to this program:

OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and Internal Control

AICPA Statement on Auditing Standards (SAS) No, 122, Statements on Auditing Standards: Clarification and Recodification

AICPA AU-C Section 210, Terms of Engagement, paragraph A23 - Form and Content of the Audit Engagement Letter

AICPA AU-C Section 240, Considering Financial Fraud in Financial Statement Audits

AICPA AU-C Section 315, Identifying and Assessing Risks of Misstatement

Standards for Internal Control in the Federal Government (GAO-14-704G), dated September 2014

OMB Circular No. A-136, Financial Reporting Requirements

The following form is used throughout this IRM:

The FMA component focuses on IRS’s internal controls over its use of, and accounting for, its financial resources. The FMA is comprised of three subcomponents: administrative, custodial and internal control.

The ACFO for Financial Management organization oversees the administrative and custodial subcomponents and the ACFO for Internal Control organization oversees the internal control subcomponent.

The IS component focuses on IRS internal controls over its key financial and tax processing systems, and its information and interconnected networks to ensure the confidentiality, integrity and availability of financial and sensitive taxpayer information.

The CIO organization coordinates activities for the IS audit component.

The GAO issues an audit notification letter to the IRS in December providing official notice that the financial statement audit is starting.

The letter provides the job assignment code and states that GAO has requested approval to access all records, files and tax return information needed to complete the audit from the Joint Committee on Taxation. If GAO already has secured an approval letter from the committee, the audit notification letter will reference that and the transmittal will include the letter from the committee.

The GAO sends the audit notification letter to CRO-EAM to disseminate it throughout the IRS as needed.

The ACFO for Financial Management and the ACFO for Internal Control update two lists of audit deliverables between November and March - the administrative/custodial PBC listing and the internal control PBC listing, respectively. The two groups update the due dates and the descriptions from the prior year's PBC listings for the current audit year and where changes are needed and get agreement from the affected IRS business units. Once the business units agree, the two groups forward their draft listings to GAO with the changes highlighted and facilitate any meetings that may be needed to finalize the listings by the end of March.

Updates to these listings can and do occur throughout the audit on an as needed basis. The appropriate IRS subject matter expert, GAO cycle team member and appropriate ACFO office coordinate all changes.

For the IS audit component, the CIO organization creates a list of documents and files as GAO requests them. This list is referred to as the IS PBC listing.

The GAO issues an audit engagement letter to the IRS between February and March that provides written objectives for the IRS financial statement audit.

The ACFO for Financial Management receives the audit engagement letter and disseminates it to the appropriate IRS staff.

The IRS issues a formal acknowledgement to GAO of the receipt of the audit engagement letter and agreement to the terms of the engagement outlined therein (as prescribed by SAS #122, Statements on Auditing Standards: Clarification and Recodification).

A formal financial statement audit entrance conference occurs every March with GAO and IRS senior executives discussing the purpose and scope of the upcoming annual financial statement audit process.

Throughout the fiscal year, IRS subject matter experts conduct meetings, conference calls and/or site visits with GAO to gain a basic understanding of how certain IRS programs and/or controls work.

The appropriate IRS senior executives provide updates to schedules and questions provided by GAO in April to help GAO understand what actions, policies, procedures and controls IRS has established to mitigate the risk of fraud and the potential of material misstatements in the financial statements. The audit requirements specifically addressed by this response are AU-C 240 (risk of fraud) and AU-C 315 (material misstatement).

The GAO performs internal control testing to determine whether IRS internal controls are properly designed and effectively implemented. They test various IRS financial reporting and information technology controls, including safeguarding of assets, segregation of duties, budget, compliance and operation controls. GAO then evaluates the results of its internal control testing to determine the extent of substantive control testing to perform. There is a direct relationship between the number of errors allowed during internal control testing for an audit area (for example, reimbursable revenue transactions, procurement disbursements) and the sample size of the subsequent substantive testing.

The GAO performs substantive testing to obtain evidence that provides reasonable assurance about whether the IRS financial statements are free of material misstatements. This involves testing IRS financial (appropriation and taxpayer-related) transactions and account balances to enable GAO to issue its audit report on IRS financial statements, internal controls and compliance with significant provisions of laws and regulations.

The ACFO for Financial Management issues a request to the IRS Chief Counsel in September asking that he or she prepare a legal representation letter response to GAO.

The GAO provides the letter’s language and requires:

The Associate Chief Counsel (General Legal Services) issues the legal representation letter to GAO in early November.

The IRS delivers the MD&A to GAO in early November.

The MD&A summarizes the IRS organization, resources, performance, challenges, risks and actions the IRS has identified to mitigate risks.

The GAO incorporates the IRS MD&A into the audit report.

The IRS delivers its annual financial statements including the principal statements and related footnotes, required supplementary information and other information to GAO in early November.

The financial statements report the IRS’s financial position and results of operations, pursuant to the requirements of the CFO Act of 1990, the Government Management Reform Act of 1994 and the Office of Management and Budget Circular No. A-136, Financial Reporting Requirements. The integrity of the information included in the financial statements is the responsibility of IRS management.

The annual IRS financial statements include:

The IRS principal financial statements include:

The GAO’s audit report includes the IRS financial statements.

The IRS issues a written confirmation to GAO in early November that representations made to the auditors during the audit regarding the completeness and reliability of audit data are accurate as of the date of the letter.

The management representations detailed in the letter cover a broad range of audit areas including financial statements, required supplementary information, other information, intra-governmental activities, internal control, fraud, compliance of financial management systems with FFMIA requirements, and budgetary and restricted funds.

The GAO meets with the IRS senior executives in late October to convey to IRS management:

At the completion of the IRS financial statement audit, GAO issues a report titled IRS's Fiscal Years 20XX and 20XX Financial Statements, in November.

This report contains the:

The GAO provides IRS with an exposure draft (restricted use only) of the upcoming management report for review and comment between March and May. The draft report identifies new deficiencies in internal control that GAO observed during the latest audit of the IRS financial statements and recommendations for action.

The IRS has about three to four weeks to respond formally to the draft report. The response includes a letter from the Commissioner and an enclosure that summarizes each new recommendation, states whether the IRS agrees with each recommendation and identifies PCAs and projected completion dates for each.

The GAO issues its official management report between April and June. In addition to identifying and discussing new deficiencies in internal control and related recommendations, the report includes enclosures that identify 1) new PCAs with projected completion dates and 2) GAO's assessment of IRS actions taken on open recommendations from prior years.

31 U.S.C. Section 720, Agency Reports, requires the IRS to send a management report response to congressional committee leadership within 180 days of GAO's issuance of its management report.

The response updates Congress on IRS’s efforts to address GAO's financial statement audit recommendations.

The response includes a letter from the Commissioner and the management report enclosure sent to GAO. If actions were to occur in the interim, the IRS sends an updated version of the enclosure.

The GAO provides IRS with exposure drafts (restricted use only) of the upcoming IS control reports (Public and LOU) for review and comment between February and May. The draft reports identify and discuss new deficiencies in internal control that GAO observed during the latest audit of the IRS financial statements. While these deficiencies are not severe enough to be considered material weaknesses or significant deficiencies, they nevertheless warrant IRS management's attention.

The IRS has about three to four weeks to formally respond to the draft reports.

The GAO issues its official IS control reports between March and July. In addition to identifying and discussing new deficiencies in internal control, the LOU report includes enclosures that identify 1) new recommendations for action and 2) summarize GAO's assessment of IRS actions taken on open recommendations from prior years.

31 U.S.C. Section 720 requires the IRS to send an IS control reports’ response to congressional committee leadership within 180 days of GAO's issuance of its reports.

The response updates Congress on IRS’s efforts to address GAO's information security audit recommendations.

The response includes a letter from the Commissioner and an enclosure that summarizes each new recommendation, states whether IRS agrees with each recommendation and identifies PCAs and projected completion dates for each.

JAMES is Treasury’s web-based audit tracking system used for tracking issues, findings, recommendations and PCAs from TIGTA and GAO audit reports. PCAs are linked in JAMES to the specific report that generated the recommendation.

The ACFO for Financial Management, Audit and Review, coordinates JAMES activities related to the financial statement audit as well as any related significant deficiencies, material weaknesses and/or remediation plans.

The ACFO for Financial Management distributes a listing of all open administrative/custodial financial statement audit recommendations to the affected business units requesting status updates in October. Business units must provide relevant backup documentation for closed actions.

The IRS provides GAO with an updated status of open recommendations in December. In addition to the status, the IRS provides backup documentation for all closed recommendations.

The GAO uses the responses and related backup documentation in conjunction with its audit testing results to assess which recommendations it will close.

The GAO publishes its assessment of IRS’s progress in an enclosure to the next management report.

The IRS provides a list of prior year IS financial statement audit recommendations to GAO between March and June with implemented PCAs and requests that GAO assess them during the next audit.

The GAO uses this list in conjunction with its audit testing results to assess which recommendations it will close.

The GAO publishes its assessment of IRS’s progress in an enclosure to the next IS control report.