IRS needs to prioritize risk management of legacy IT systems, GAO says

It’s universally acknowledged that the Internal Revenue Service has some really old IT systems. However, despite the regular attention on that challenge, the Government Accountability Office is concerned that the tax-collection agency still isn’t prepared to deal with issues that may arise.

GAO surveyed the IRS’s IT operations — new investments as well as systems in the operations and maintenance phase — and came up with mixed results. As part of that, the congressional watchdog revisited known older risks and found that the IRS needs better plans for mitigating them.

In the case of the four new investment-stage IT systems GAO looked at, the IRS had spent less money than initially planned. However, less positively, most of the systems were found to be “behind schedule and delivered less scope than planned.”

The GAO also looked at five systems in the operations and maintenance phase and found that most met key performance targets — at least for now.

The report expressed some concern about the IRS’s preparedness to deal with its legacy systems as they, inevitably, continue to age. Systems like the Individual Master File, Integrated Data Retrieval System and Mainframes and Servers Services and Support “are facing significant risks due to their reliance on legacy programming languages, outdated hardware, and a shortage of human resources with critical skills.”

And, GAO argues, the IRS does not have the necessary risk management protocol in place. “Despite these risks, the agency has not fully implemented key risk management practices and may be challenged in mitigating risks effectively so that they do not impact the agency’s ability to carry out its mission,” GAO writes.

GAO’s concern isn’t theoretical. In April, hours from the 2017 filing deadline, the IRS’ e-file system crashed for several hours because of issues with the Individual Master File. The failure forced the IRS to extend its filing deadline.

Finally, the report addresses IT workforce planning necessities. While the IRS has started some planning efforts, the report states, it hasn’t actually implemented them yet. According to best practices, the IRS needs to create a strategy for workforce planning, assess the gaps in its IT workforce, develop strategies to fill these gaps and closely monitor progress on addressing skill gaps.

“Until the agency implements these practices, it will continue to face challenges in assessing and addressing the gaps in knowledge and skills that are critical to the success of its key investments,” GAO writes.

The report makes 21 recommendations — the IRS neither agreed nor disagreed with the specific recommendations but stated it would soon furnish a plan to deal with each area of concern.

The IRS spent around $2.7 billion on IT in fiscal 2016. In keeping with many agencies across the federal government, approximately $1.9 billion (70 percent) of that total was spent for operations and maintenance activities, while just $800 million (30 percent) was spent for development, modernization and enhancement.