Prior editions of Publication 1075 required a background investigation but did not detail what that investigation must include. During the 2014 Treasury Inspector General for Tax Administration audit several state agencies were asked to provide copies of background check policy and procedures. Results varied from very thorough standards to no checks at all. This resulted in a Finding and Recommendation for the Office of Safeguards. Recommendation: Establish and ensure that background investigation requirements for all agency employees and contractors that have access to FTI are consistent with the IRS’s background investigation requirements for access to FTI. The effective date for the new background investigation requirement was immediate with the initial publish date of the updated background investigation requirements in September 2016. Our expectations from agencies for compliance to this requirement are an accurate reflection of current background investigation policy and procedures or actions taken and status of the implementation of new background investigation policy and procedures. If the agency receives a background investigation finding during a safeguard review we expect a timely response on the Corrective Action Plan (CAP) and documented continued progress. Many states have already passed Pub. L. 92-544 conforming laws authorizing FBI criminal history record checks of state and local government employees and contractors holding positions of trust. Hence, the state may be able to leverage existing state Pub. L. 92-544 laws to ensure state agency employees and contractors with access to or use of FTI have an FBI criminal history record check. Treasury classifies FTI as Moderate Risk Public Trust data requiring a Tier 2 investigation. The form associated with this level of investigation is SF85P. IRS sees state need for flexibility in determination of how background investigation requirements will be utilized. Some scale back of requirements has already taking place based on conversations with stakeholders, practical concerns, and pushback on TIGTA mandate. Requirement will be that state uses background investigations as part of vetting determination without specification or standardization as to how they use the information. States will have to decide for themselves their comfort level with risk of limited use of background information received and the potential for breach and/or negative consequences of breach. IRS utilization of FIS FEDCAS requirements is almost 30 separate items. IRS proposes reduction to three basic items. Background investigations for any individual granted access to FTI must include, at a minimum: FBI fingerprinting (FD-258) – review of Federal Bureau of Investigation (FBI) fingerprint results conducted to identify possible suitability issues. (Contact the appropriate state identification bureau for the correct procedures to follow.) The principal purpose of the FBI fingerprinting (FD-258) and the associated information/biometrics provided by the employing, investigating or otherwise responsible agency, is for the purpose of comparing the individuals/employee’s fingerprints to other fingerprints in the FBI’s Next Generation Identification (NGI) system or its successors system (including civil, criminal, and latent fingerprints repositories) or other available records of the employing, investigating, or otherwise responsible agency. The FBI may retain the fingerprints and associated information/biometrics in NGI after the completion of this application and, while retained, the fingerprints may continue to be compared against other fingerprints submitted to or retained by NGI. During the processing of the application and for as long thereafter as the individual/employee’s fingerprints and associated information/biometrics are retained in NGI, his/her information may be disclosed pursuant to his/her consent, and may be disclosed without his/her consent as permitted by Privacy Act of 1074 and all applicable Routine Uses as may be published at any time in the Federal Register, including the Routine Uses for the NGI system and the FBI’s Blanket Routine Uses. Routine Uses include, but are not limited to, disclosure to: employing, governmental or authorized non-governmental agencies responsible for employment, contracting licensing, security clearances, and other suitability determinations; local, state, tribal or federal law enforcement agencies; criminal justice agencies, and agencies responsible for national security and public safety. Furthermore fingerprints are not only to authenticate an individual’s identity, but more importantly, to figure out who someone is (by a fingerprint left on a murder weapon or a bomb, for example), typically by scanning a database of records for a match. Since fingerprints vary from person to person and don’t change over time, this is an effective way of identifying fugitives and helping to prove both guilt and innocence. The FBI fingerprints results will provide an Identity History Summary, often referred to as a criminal history record or a “rap sheet”, which is a listing of certain information taken from fingerprint submissions retained by the FBI in connection with arrests and, in some instances, federal employment, naturalization, or military service. If the fingerprints are related to an arrest, the Identity History Summary includes name of the agency that submitted the fingerprints to the FBI, the date of the arrest, the arrest charge, and the disposition of the arrest, if known to the FBI. All arrest data included in an Identity History Summary is obtained from fingerprint submissions, disposition reports, and other information submitted by agencies having criminal justice responsibilities. Check of local law enforcement agencies where the subject has lived, worked, and/or attended school within the last five years, and if applicable, of the appropriate agency for any identified arrests. A local law enforcement agency is referred to the city and/or town law enforcement department. In many cities and small towns, arrest, incidents, complaints, reports, etc. will stay at the city or town level and will not appear at the county or at the state law enforcement agency. Hence, a more complete background investigation is to request the records of the local city or town law enforcement agency where the individual/employee resides. If the individual/employee has lived, worked and attended schools in several different cities and/or towns in the last 5 years, then he/she will need to provide a background investigation for all the cities and/or towns he/she lived, worked and/or attended schools within the last 5 years. Check with your state to verify as some states may be able to conduct this local search for you. Citizenship/residency – Validate the subject’s eligibility to legally work in the United States (e.g., a United States citizen or foreign citizen with the necessary authorization). Employers must complete USCIS Form I-9 to document verification of the identity and employment authorization of each new employee hired after November 16, 1986, to work in the United States. Within 3 days of completion, any new employee must also be processed through E-Verify to assist with verification of his/her status and the documents provided with the Form I-9. The E-Verify system is free of charge and can be located at E-Verify. This verification process may only be completed on new employees. Any employee with expiring employment eligibility must be documented and monitored for continued compliance. It is the responsibility of the agency to ensure that all three elements of the background check requirements have been timely met and is updated on a timely basis for all employees. If an agency uses the FBI Rap Back program, the 5-year minimum recheck is satisfied. The agency retains the authority to make personnel related decisions; however, should an employee fail one of the background check elements set by the state they should not be authorized to have access to FTI. Disclosure Enforcement Specialist (DES) will be reviewing the background checks during the Safeguard Review. Should a DES find an employee that has access to FTI that does not have a satisfactory background check the agency will receive a finding for having authorized access to FTI by an individual who does not have a satisfactory background check. Resources Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies PDF Office of Personnel Management (OPM) Background Investigations website Federal Bureau of Investigations (FBI) Criminal Justice Information Services (CJIS) website Federal Bureau of Investigations (FBI) Privacy Act Statement United States Citizenship and Immigration Services E-Verify website Form SF85P, Questionnaire for Public Trust Positions
