Internal controls are a major part of effectively managing an organization. They comprise of the plans, methods and procedures used to meet missions, goals and objectives. Internal controls support performance-based management. Effective systems of internal control provide unmodified assurance that the IRS achieves the following objectives:

All employees must be committed to implementing effective and efficient internal controls. The Department of the Treasury (Treasury), TIGTA and the Government Accountability Office (GAO) provide oversight to evaluate whether control strategies that mitigate program and administrative operational risks are implemented.

Internal controls are the responsibility of every employee. Managers are accountable for and have stewardship of all assigned operations within their organization, including program, administrative and financial, such as:

It is important to identify problem areas and take appropriate corrective actions before external auditors, such as GAO and TIGTA, issue findings or before problems escalate into serious control weaknesses. On the other hand, there must be an appropriate balance of control in programs and operations. For example, an over-controlled process or program may be costly to implement and interfere with program accomplishment. Similarly, an uncontrolled or under-controlled process or program may allow problems to go unnoticed and assets to be wasted.

Internal controls focus and awareness should be an integral part of all managers’ and employees’ daily activities. By fostering open, honest communications and promoting problem-solving within an organization, managers create an environment where internal controls are acknowledged as tools to achieve goals.

The Budget and Accounting Procedures Act of 1950, requires the head of each federal department and agency establish and maintain adequate systems of management controls:

The Federal Managers’ Financial Act of 1982, (FMFIA) and Office of Management and Budget (OMB) Circular A-123, Management’s Responsibility for Enterprise Risk Management and Internal Control require federal agencies to improve accountability in federal programs and operations.

The CFO Act of 1990, as amended, requires agencies provide audited financial statements made available to the public.

The Federal Financial Management Improvement Act of 1996 (FFMIA) Financial Management Systems and Appendix D to OMB Circular No. A-123 , require financial systems reviews.

The Government Performance and Results Act Modernization Act of 2010 (GPRAMA) requires annual performance plans and reports.

The Reports Consolidation Act of 2000, requires the Annual Assurance Statement to include reliable Performance Measures.

The Federal Information Security Modernization Act of 2014 (FISMA) and OMB Circular, A-130 Managing Information as a Strategic Resource require annual systems performance and security reviews.

The Standards for Internal Control in the Federal Government, (known as the "Green Book”) provide the overall framework for establishing and maintaining as effective internal control system.

Treasury Directive 40-04, provides guidance on appropriate internal control and implementation for internal control statutes, regulations and other requirements.

Inspector General Act 1978, as amended, 5 U.S.C. Appendix 3, grants the Office of the Inspector General (OIG) administrative authority.

This section provides responsibilities for:

Program reports include:

Program effectiveness is determined by:

The MC ESC is responsible for:

The following terms and definitions apply to this program:

The following acronyms apply to this program:

The following IRMs are the most significant IRMs that affect the IRS’s management controls program:

The steps to downgrade a material weakness or to close a significant deficiency are:

The annual assurance review process focuses on the adequacy of internal controls within an organization. Managers assess risks (for example, the probability of a negative, unanticipated occurrence) of operations, determine whether controls mitigate those risks and report whether those controls are effective. If managers identify weaknesses in their internal control procedures, they are required to report them to the responsible officials and business unit leadership so that a corrective action plan can be developed and implemented.

Each spring, the CFO issues guidance to the Deputy Commissioners, Division Commissioners, Chiefs, Directors, National Taxpayer Advocate and Chief Counsel on the annual self-assessment of internal controls, known as the Internal Controls Managerial Assessment (ICMA) and on preparing the annual assurance memorandum for their organizations.

All managers use the ICMA to conduct an annual self-assessment of their internal controls. Managers review the effectiveness of controls within their own area of responsibility and verify that adequate management controls are in place and functioning effectively to accomplish organizational goals and protect IRS resources. The involvement of each level of management in assessing the control environment within their areas is necessary in identifying risks at all levels.

Managers should report a problem in the design or operation of an internal control to the next level of management as an internal control deficiency. Heads of business units should determine if any reported internal control weaknesses warrant inclusion in their Statement of Assurance memorandum. The MC ESC will determine if the internal control deficiency rises to the level of a significant deficiency or a material weakness. The IRS reports significant deficiencies and material weaknesses to Treasury.

Heads of business units review the ICMA results of their subordinate managers and prepare a Statement of Assurance memorandum indicating the status of their business unit’s internal controls. Heads of business units also consider external auditor reports, internal studies and assessments and other known factors.

The Statement of Assurance memorandum is a one or two-page document containing a specific statement regarding the level of assurance of the business unit’s internal controls. There are three types of assurance:

The Statement of Assurance memorandum briefly describes the process used to assess whether adequate internal controls are in place and functioning effectively to accomplish organizational goals and protect IRS resources. Preparers consider the information systems environment operated or used by their organizations and issues identified by GAO, TIGTA and IRS management reviews (if applicable) in preparing the memorandum.

Corrective action plans for newly identified internal control deficiencies should be included with the Statement of Assurance memorandum. Managers execute actions necessary to resolve internal control deficiencies, regardless of whether the MC ESC deems them significant deficiencies or material weaknesses. Corrective action plans for internal control deficiencies identified in the previous fiscal year will be updated.

Internal control deficiencies that have been corrected will be submitted with a certificate of completion describing the validation process and the results indicator data that verifies that the internal control weakness has been corrected.

The MC ESC will review and evaluate these documents and other relevant information to recommend to the Commissioner the level of assurance for submission in the IRS’s Annual Assurance Statement and any newly identified material weaknesses or significant deficiencies.

The Commissioner signs and submits an Annual Assurance Statement to Treasury in early November each year.

The Commissioner also provides an additional management Assurance Statement that is included in the annual IRS Financial Report. This management assurance is provided at the IRS bureau level and is intended to mirror agency requirements for reporting on internal controls over reporting, as described in OMB Circular A-123 and OMB Circular A-136, Financial Reporting Requirements. Like the Commissioner’s Annual Assurance Statement, the Commissioner’s IRS Financial Report management Assurance Statement is signed and submitted in early November of each year.

In fiscal year 2012, the IRS expanded its annual assurance process to identify key program evaluations, managerial, operational, security and quality assurance (“reviews”) conducted by the business units to assess the effectiveness of IRS internal controls. These internal control reviews are important to the IRS and can result in greater efficiency, better taxpayer experiences and more effective responses to issues identified by GAO and TIGTA. See IRM 1.4.31, IRS Quality Assurance Review Program for information on the Quality Assurance Review Program.

IC provides business units with insight into the effectiveness of their implemented corrective actions for audit recommendations issued by GAO and TIGTA and evaluates critical controls over IRS programs identified as high risk, high impact or high visibility. This independent examination is known as an Internal Control Review (ICR) and assists IRS business units when they review and evaluate their internal control processes. See IRMs 1.4.3, Financial Assurance Control Testing and 1.4.32, Internal Control Review Program for additional information on the IC review Program.

Outreach and Reporting (OR) works with external stakeholders to manage and control oversight processes through the MC ESC and the Subgroup.

Outreach and Education section promotes internal control across the IRS by coordinating activities with and among staff throughout the IC organization. The Internal Controls Outreach & Education Program assists IRS business units in following through on organizational commitments, policy objectives, applicable laws, regulations and related processes and procedures. The overall goal is to enhance efficient and effective operations by increasing awareness of internal control through collaboration, communication, education and training.

Managers are responsible for determining what levels of risk they are willing to assume. Assessing risk enables managers to reduce unwanted surprises.

The Office of the Chief Risk Officer oversees Enterprise Risk Management (ERM). The ERM program provides an agency-wide approach to risk management and helps IRS units incorporate risk management principles into strategies and daily operations. See IRM 1.1.31, Organization and Staffing, Office of the Chief Risk Officer for additional information regarding the responsibilities of the Chief Risk Officer.

An effective control environment accomplishes the following:

Risk assessments allow the IRS to be aware of any internal and external risks that could affect its ability to meet its goals. Through risk assessments, the IRS can manage risks better by establishing appropriate internal controls to mitigate or minimize risks to acceptable levels.

Risk assessments are iterative processes and should be reviewed and updated when changes occur or new risks emerge.

Management should establish only those control activities necessary to accomplish the IRS mission and objectives effectively and efficiently.

The following chart provides the timing, method and type of controls management can leverage in developing a control.

Management has a critical role in the internal control system. Managers should focus their monitoring activities on high-risk areas.

Management should review tasks or techniques to provide a reasonable level of confidence that controls are functioning as intended.

Management is responsible for governance of testing the design and operating effectiveness of internal controls.

In testing the design of an internal control, management is responsible for validating that the internal controls, if implemented effectively, would address the identified risk.

In testing the effectiveness of internal controls, management is responsible for validating whether the control operated effectively and consistently over a period of time.

The GAO and TIGTA audit and investigate IRS operations to:

The timely closure of GAO and TIGTA audit recommendations are a positive indicator on the IRS’s control environment.

The Deputy Commissioner for Operations Support and the Deputy Commissioner for Services and Enforcement are co-chairs of the MC ESC. The CFO is the vice-chair. The members are the TDCFO; Commissioner, Small Business/Self Employed; Commissioner, Wage and Investment; Commissioner, Large Business and International; Commissioner, Tax Exempt and Government Entities; Chief Information Officer; Chief Risk Officer; Chief, Facilities Management and Security Services; Chief Privacy Officer and Human Capital Officer.

The CFO chairs the MC ESC Subgroup. The other participants are the Associate CFO for IC and support staff, decision-making executive representatives of the MC ESC voting members and program managers responsible for the topics/issues being discussed by the MC ESC.

The MC ESC oversees management’s design, implementation and operation of the IRS’s internal control system to ensure that internal controls are universally recognized as a shared responsibility and that internal control deficiencies are identified, analyzed and remediated. The MC ESC’s operations are governed by a charter maintained by IC.

The MC ESC’s mission is to ensure that all business units and functions identify, address and correct internal control deficiencies and recognize the importance of their shared responsibility for designing and implementing strong internal controls.

The MC ESC’s objectives are to build a strong relationship between risk management and internal controls and ensure existing and new controls address identified risks effectively; ensure the remediation of existing control weaknesses and prevent new ones from arising; provide an unmodified Statement of Assurance that IRS internal controls are in place and functioning effectively and achieve an unmodified audit opinion on the IRS’s financial statements.

The MC ESC oversees Servicewide progress in closing open financial statement audit recommendations.

The MC ESC also:

The office of the Associate CFO for IC identifies MC ESC agenda topics for:

The office of the Chief Risk Officer identifies MC ESC agenda topics for: