IRS systems were accessible to thousands of staffers on leave, watchdog finds

Thousands of IRS employees who opted in to the federal government’s deferred resignation programs still had access to agency systems after exiting their roles, according to a new watchdog report.

Out of the nearly 21,500 IRS staffers who signed on for a DRP, roughly 17,000 retained access to the main agency network while on administrative leave as of June 2025, the Treasury Inspector General for Tax Administration found. 

Another 14,000 were still able to connect with one or more “sensitive” IRS systems, per TIGTA’s report, which was released last week.

“These employees did not have a legitimate business reason to retain this access and posed a potential security risk for unauthorized disclosure of sensitive information,” the watchdog wrote. 

The report follows TIGTA’s previous examinations into how the IRS safeguards taxpayer information on its IT systems. That included a 2024 audit launched following the leak of President Donald Trump and other wealthy taxpayers’ returns by IRS contractor Charles Littlejohn.

Littlejohn is serving a five-year prison sentence for the leaks, which occurred during the first Trump administration from 2018-2020. The Treasury Department in January canceled all of its contracts with Booz Allen, which employed Littlejohn at the time. 

“In that evaluation, we reported that procedures to systemically remove users who no longer required access to sensitive systems were not always working as intended,” TIGTA recounted in its new report. “We also identified that the IRS did not always remove contractor access to sensitive systems when background investigations were not favorable.”

The watchdog ultimately determined that the IRS had not taken the right steps to make sure its systems were accessible only to authorized staffers and contractors — though the tax agency  “indicated that it was working to manually remove the access of these employees.”

The IRS did demonstrate to TIGTA that it was making progress with those removals, bumping more than 15,000 ex-staffers off the network by August 2025 and cutting 6,000 or so off from the sensitive systems.

“While we acknowledge the IRS took swift action, they still must implement a process to immediately terminate system access when a business need to access taxpayer information no longer exists,” the watchdog said.

TIGTA’s report delivered five recommendations to the IRS, including callouts for the chief information officer to work with the human capital office to revoke network access to departed employees, create procedures to recover personal identity verification cards, and ensure all IRS-Criminal Investigation users have updated network access records in the agency’s Business Entitlement Access Request System. 

The agency agreed with four TIGTA recommendations and partially agreed with a fifth, which prodded the IRS to list specific training course requirements for systems access in the Internal Revenue Manual.

“For that recommendation, the IRS will address the underlying risk by taking an alternative approach that ensures we maintain an authoritative source of the current training requirements while avoiding unnecessary administrative burden,” IRS CIO Kaschit Pandya said in a memo to the deputy inspector general for inspections and evaluations.