oversight

IRS Lockbox Banks: More Effective Oversight, Stronger Controls, and Further Study of Costs and Benefits are Needed

Published by the Government Accountability Office on 2003-01-15.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

               United States General Accounting Office

GAO            Report to Chairman and Ranking
               Minority Member, Committee on
               Finance, U.S. Senate


January 2003
               IRS LOCKBOX BANKS
               More Effective
               Oversight, Stronger
               Controls, and Further
               Study of Costs and
               Benefits Are Needed




GAO-03-299
               a
                                               January 2003


                                               IRS LOCKBOX BANKS

                                               More Effective Oversight, Stronger
Highlights of GAO-03-299, a report to the      Controls, and Further Study of Costs and
Committee on Finance, U.S. Senate
                                               Benefits Are Needed



Lockbox banks are commercial                   FMS has contractual agreements with four lockbox banks, which operate
banks that process certain taxpayer            11 lockbox sites at nine locations on IRS’s behalf. Of the more than
receipts on behalf of the Internal             $2 trillion in tax receipts that IRS collected in fiscal year 2002, lockbox
Revenue Service (IRS). Following               banks processed approximately $268 billion.
an incident at a lockbox site during
2001, which involved the loss and
destruction of about 78,000 tax
                                               The findings of GAO’s study include the following:
receipts totaling more than                    •     Nothing inherent in the lockbox contractual agreements would
$1.2 billion, the Committee asked                    necessarily contribute to mishandling of tax receipts. Although a desire
GAO to examine whether                               to avoid negative consequences, such as financial or other penalties
(1) provisions of the contracts
                                                     allowed for by the agreements, could motivate bank employees to make
under which lockbox banks
operate address previously                           poor decisions, penalty provisions are necessary to help the government
identified problems or might                         address inadequate performance. The results of an ongoing investigation
contribute to mishandling of tax                     of the 2001 incident may help IRS and FMS determine whether new
receipts, (2) oversight of lockbox                   provisions or modifications to existing provisions are needed.
banks is adequate, (3) internal                •     Although IRS and FMS have significantly increased their presence at
controls are sufficient, and (4) IRS                 lockbox sites, oversight of lockbox banks during fiscal year 2002 was not
and Treasury’s Financial
                                                     fully effective to ensure that taxpayer data and receipts were adequately
Management Service (FMS) had
considered the costs and benefits                    safeguarded and properly processed. Inadequate oversight resulted
of contracting out the functions                     mainly from (1) a lack of clear oversight directives and policies,
performed by lockbox banks.                          (2) failure to perform key oversight functions, and (3) conflicting roles
                                                     and responsibilities of IRS personnel responsible for day-to-day
                                                     oversight of lockbox banks.
                                               •     Internal controls, including physical security controls, need to be
GAO is making recommendations
                                                     strengthened at IRS lockbox locations (see table below). In addition, the
to improve oversight and internal
controls at IRS lockbox banks. In                    processing guidelines under which IRS lockbox banks operate need to
addition, GAO is recommending                        be revised to improve receipt-processing controls, employment
that a study of the benefits and                     screening, and courier security.
costs, including opportunity costs,            •     IRS and FMS have not performed a comprehensive study of the costs
of using lockbox banks to process                    and benefits of using lockbox banks. The most recent study, in 1999,
tax receipts be completed before                     omitted some costs that may have affected the result. For example, the
the current lockbox bank contracts
                                                     study did not consider opportunity costs—benefits forgone that might
expire in 2007.
                                                     have resulted from alternative uses of the money. Because of these
In commenting on a draft of this                     omissions and several changes that have affected costs and benefits, a
report, FMS and IRS agreed with                      new study will be needed before lockbox contracts expire in 2007.
our recommendations and have
initiated or plan to initiate actions
                                               Internal Control Issues Found at Lockbox Locations in Calendar Year 2002
to implement them.
                                                Lockbox bank location                               1         2   3   4   5   6   7   8   9
                                                   Physical security issues                         X         X   X   X   X   X   X   X   X
                                                   Processing control issues                        X         X   X   X   X   X   X   X
www.gao.gov/cgi-bin/getrpt?GAO-03-299.             Courier security issues                                    X   X       X
                                                   Employee screening issues                        X         X   X               X   X
To view the full report, including the scope
and methodology, click on the link above.      Source: Findings based on reviews at the nine lockbox locations.
For more information, contact Steven J.
Sebastian (202-512-3406).
Contents



Letter                                                                                                 1
                             Results in Brief                                                          3
                             Background                                                                6
                             Scope and Methodology                                                    10
                             It Is Not Known Whether Contract Provisions Could Contribute to
                                 Improper Handling of Taxpayer Receipts                               12
                             Oversight of Lockbox Banks Was Not Fully Effective                       15
                             Lockbox Banks’ Internal Control Deficiencies Expose the Federal
                                 Government to Theft and Loss                                         25
                             A Comprehensive Study Evaluating Costs for IRS Processing Versus
                                 Using Lockbox Banks for All Types of Tax Receipts Has Not Been
                                 Performed                                                            30
                             Conclusions                                                              37
                             Recommendations for Executive Action                                     38
                             Agency Comments and Our Evaluation                                       42


Appendixes
              Appendix I:    Internal Control Weaknesses                                              44
             Appendix II:    GAO Analysis of IRS’s and FMS’s August 1999 1040 Tax
                             Payment Comparative Cost Benefit Study                                   63
             Appendix III:   Comments from the Department of the Treasury                             69
                             GAO Comments                                                             75
             Appendix IV:    GAO Contacts and Staff Acknowledgments                                   76
                             GAO Contacts                                                             76
                             Acknowledgments                                                          76


Tables                       Table 1: Internal Control Issues Found at Lockbox Locations in
                                      Calendar Year 2002                                              26
                             Table 2: Comparison of the Cost to the Federal Government of
                                      Alternative Receipt Processing Approaches, Fiscal Years
                                      2001-2007                                                       32
                             Table 3: IRS and Lockbox Banks Cost and Saving Estimates for the
                                      Federal Government, Fiscal Years 2001 through 2007              63
                             Table 4: IRS and Lockbox Banks Cost and Saving Estimates Under
                                      IRS Scenario I for the Federal Government, Fiscal Years
                                      2001 through 2007                                               64
                             Table 5: IRS’s Fiscal Year 2001 Labor Cost                               66




                             Page i                                          GAO-03-299 IRS Lockbox Banks
          Contents




Figures   Figure 1: Flow of lockbox collections and dataFMS formalized the
                    lockbox                                                                          7
          Figure 2: Fiscal Year 2002 Dollar Value and Volume of Collections
                    for Three Major Types of Tax Receipt Collection
                    Mechanisms                                                                       9




          Abbreviations

          AES          automated entry system
          AWSS         Agency-Wide Shared Services
          EFTPS        Electronic Federal Tax Payment System
          FAR          Federal Acquisition Regulation
          FMS          Financial Management Service
          FSD          Financial Services Division
          IRM          Internal Revenue Manual
          IRS          Internal Revenue Service
          LPG          Lockbox Processing Guidelines
          NPV          net present value
          OIG          Office of Inspector General
          PCD          program completion date
          TFM          Treasury Financial Manual
          TIGTA        Treasury Inspector General for Tax Administration
          TTB          Treasury Time Balances

           This is a work of the U.S. Government and is not subject to copyright protection in the
           United States. It may be reproduced and distributed in its entirety without further
           permission from GAO. It may contain copyrighted graphics, images or other materials.
           Permission from the copyright holder may be necessary should you wish to reproduce
           copyrighted materials separately from GAO’s product.




          Page ii                                                    GAO-03-299 IRS Lockbox Banks
A
United States General Accounting Office
Washington, D.C. 20548



                                    January 15, 2003                                                                                Leter




                                    The Honorable Max Baucus
                                    Chairman, Committee on Finance
                                    United States Senate

                                    The Honorable Charles E. Grassley
                                    Chairman (designate), Committee on Finance
                                    United States Senate

                                    In its role as the nation’s tax collector, the Internal Revenue Service (IRS)
                                    collected over $2 trillion during fiscal year 2002. Of that amount, $1.5
                                    trillion was collected through electronic means,1 financial institutions
                                    serving as lockbox banks collected more than $268 billion, and IRS offices
                                    collected $86 billion.

                                    A lockbox bank is a commercial bank with a designated post office box to
                                    which taxpayers are instructed to mail their payments and related tax
                                    documents. Lockbox banks process the documents, deposit the receipts,
                                    and then forward the documents and data to IRS’s Submission Processing
                                    Centers, which update taxpayers’ accounts. The Department of the
                                    Treasury’s Financial Management Service (FMS) has contractual
                                    agreements2 with four lockbox banks, which operate 11 lockbox sites at
                                    nine locations on IRS’s behalf. The intent of the lockbox program is to
                                    accelerate the deposit of tax receipts and increase interest savings, thus
                                    enhancing the efficiency of government cash management. Lockbox banks
                                    have been used since 1984 for this purpose.




                                    1
                                     Business and individual taxpayers use the Electronic Federal Tax Payment System
                                    (EFTPS) to pay taxes. EFTPS is an electronic system managed by two financial agent banks
                                    chosen by the Department of the Treasury.
                                    2
                                     Pursuant to 12 U.S.C. 265 and other authorities, the Secretary of the Treasury has authority
                                    to designate financial institutions as depositaries and financial agents of the U.S.
                                    government to perform certain financial services, including lockbox services. These
                                    agreements are legally binding but are not considered procurements subject to the
                                    provisions of the Federal Property and Administrative Services Act (41 U.S.C. §§ 251-260) or
                                    the Federal Acquisition Regulation (FAR). In this report, we refer to them as contractual
                                    agreements and use the terms “contracts” and “contractors” for ease of reference.




                                    Page 1                                                       GAO-03-299 IRS Lockbox Banks
Instances of fraud, waste, and abuse have occurred at IRS lockbox banks
over the years. In 2001, approximately 78,000 federal tax receipts, valued at
more than $1.2 billion, were lost or destroyed at a lockbox bank operated
by the Mellon Financial Corporation in Pittsburgh, Pennsylvania. Instances
of employees stealing and cashing taxpayer receipts have also occurred at
lockbox banks. Although FMS and IRS have taken steps to increase
monitoring of and internal controls at lockbox banks as a result of the loss
and destruction of tax receipts at the Pittsburgh lockbox site, we and
others, including the Treasury Inspector General for Tax Administration
(TIGTA) and offices within IRS and FMS, continue to find internal control
weaknesses at lockbox banks.3

The purpose of this report is to respond to your request that we review
existing and planned security and internal control measures at all lockbox
banks that have agreements with FMS to provide tax receipt processing
services for IRS. Specifically, you asked that we

• determine whether the new lockbox agreements in effect beginning in
  2002 address previously identified problems and whether contract
  provisions may contribute to improper handling of taxpayer returns,

• determine the adequacy of FMS’s and IRS’s oversight in monitoring
  lockbox banks’ adherence to the contractual agreements and lockbox
  processing guidelines,

• determine whether controls over processing and safeguarding of
  taxpayer receipts and data are in place and are working effectively, and

• assess the extent to which IRS and FMS considered the costs and
  benefits of contracting out the functions performed by the lockbox
  banks instead of using IRS employees.

To meet these objectives, we (1) reviewed reports relevant to oversight and
management of the lockbox program, (2) reviewed laws, regulations, and
guidance related to federal cash management activities, (3) interviewed
FMS and IRS officials, (4) compared the 1993 and 2002 lockbox bank

3
 See U.S. General Accounting Office, Internal Revenue Service: Progress Made, but Further
Actions Needed to Improve Financial Management, GAO-02-35 (Washington, D.C.: Oct. 19,
2001); U.S. Department of the Treasury, Treasury Inspector General for Tax Administration,
Nationwide Guidelines and Controls for Lockbox Banks Need Further Improvement, 2002-
30-180 (Washington, D.C.: Sept. 18, 2002).




Page 2                                                    GAO-03-299 IRS Lockbox Banks
                   contractual agreements, and (5) reviewed FMS and IRS policies, guidelines,
                   checklists, and reports from oversight reviews. We also visited two IRS
                   Submission Processing Centers and all nine lockbox locations, and
                   reviewed and discussed with FMS and IRS studies on the costs and benefits
                   of processing tax receipts by lockbox banks. As agreed with your office, we
                   did not specifically review the mishandling incident at the Pittsburgh
                   lockbox site since an ongoing investigation was in process.



Results in Brief   We found nothing inherent in the new 2002 lockbox bank contractual
                   agreements or the prior agreements that would necessarily contribute to
                   mishandling of taxpayer receipts. The agreements do contain penalty
                   provisions that can lead to negative consequences for banks if their work
                   does not meet quality standards or is not performed within required time
                   frames. The consequences range from financial penalties to termination of
                   the lockbox agreement. Although a desire to avoid negative consequences
                   could motivate lockbox bank employees to make poor decisions in
                   handling taxpayer receipts, penalty and termination provisions are
                   necessary to help the federal government address inadequate contractor
                   performance. As with any federal contract, effective oversight of
                   contractor performance is critical.

                   FMS and IRS made some enhancements to the 2002 agreements, such as
                   the addition of a new performance penalty and clarification of other
                   provisions. Because TIGTA’s investigation of the incident involving the loss
                   and destruction of tax receipts by employees at the Pittsburgh lockbox site
                   during the 2001 April peak processing period is still ongoing, it is unclear
                   whether any provisions in the lockbox agreements may have contributed to
                   the mishandling incident. When the results of the investigation are known,
                   FMS and IRS should determine whether contract provisions need to be
                   modified or whether additional controls need to be implemented.

                   Although both IRS and FMS have significantly increased their presence at
                   lockbox banks and made other improvements, oversight of lockbox banks
                   was not fully effective for fiscal year 2002 to ensure that taxpayer data and
                   receipts were adequately safeguarded and properly processed. The
                   weaknesses in oversight resulted largely from (1) a lack of clear directives
                   and documented policies and procedures for various oversight functions,
                   (2) key oversight functions not being performed, and (3) conflicting roles
                   and responsibilities for IRS lockbox coordinators. The lack of defined
                   oversight roles and responsibilities resulted in (1) IRS and FMS failing to
                   take official action on bank requests for waivers from required processing



                   Page 3                                            GAO-03-299 IRS Lockbox Banks
guidelines, thus permitting banks to operate for months with internal
control deficiencies, (2) FMS not always obtaining responses from lockbox
bank management to findings and recommendations from FMS on-site
reviews, (3) key IRS officials not always participating in security reviews in
which they had agreed to participate and for which they had the expertise,
and (4) instances of incomplete and inadequate on-site reviews. In addition,
the IRS personnel who perform compliance reviews at the lockbox sites
have conflicting responsibilities—to monitor bank compliance with the
processing guidelines and to assist the banks with required production
goals—that could affect their ability to objectively oversee lockbox banks
for which they have responsibility. These deficiencies weaken the
effectiveness of FMS’s and IRS’s oversight of lockbox banks. Also, without
clearly defined and documented oversight requirements, there is less
assurance that the oversight improvements made during 2002 will be
sustained.

We found during our reviews at the nine lockbox bank locations that
internal controls, including physical security controls, need to be
strengthened and that lockbox processing guidelines need to be revised to
ensure that taxpayer data and receipts are adequately safeguarded. For
example, we found required door alarms at several banks that were barely
audible or did not elicit the expected responses from security guards, and
we found prohibited types of personal belongings, such as bulky coats or
carrying bags that could be used to conceal items, in the tax receipt
processing areas of several locations. These weaknesses increase the risk
that taxpayer data or receipts could be stolen from the processing area. We
also found that improvements are needed in the lockbox processing
guidelines with respect to processing controls, employment screening, and
courier security. For example, IRS lockbox processing guidelines do not
require lockbox bank couriers and permanent employees to undergo the
same type of background investigation that IRS couriers and contractors
undergo, even though lockbox bank couriers and permanent employees
have the same access to taxpayer data and receipts as IRS couriers and
contractors. Ensuring that effective lockbox processing guidelines are in
place and being followed decreases the risk of loss, theft, and mishandling
of taxpayer receipts and data.

IRS and FMS have not performed a comprehensive study that evaluates the
cost of IRS processing tax receipts and the cost of lockbox banks
processing tax receipts for all types of tax receipts currently processed by
the banks. The most recent study, jointly performed by IRS and FMS in
1999, considered the costs of processing individual tax receipts only and



Page 4                                             GAO-03-299 IRS Lockbox Banks
did not consider all of the costs and benefits of using lockbox banks rather
than IRS to process individual tax receipts. In addition, the study focused
exclusively on the costs and benefits to the federal government resulting
from speedier deposit of tax receipts. Having adopted this approach using
Treasury guidance, IRS and FMS did not consider certain costs, most
notably opportunity costs, or the benefits forgone that might have resulted
from alternative uses of the money spent to achieve speedier deposits.
Agencies receive budgets that they are expected to use to achieve their
missions economically and efficiently. IRS and FMS did not consider
whether forgoing the speedier deposit of tax receipts and using IRS’s funds
elsewhere, such as within other high-yield compliance activities, might
result in financial benefits to the government that would be greater than
those generated by accelerating the deposit of tax receipts. FMS and IRS
also did not clearly define in the 1999 study the type of analysis that had
been conducted. Clearly defining the type of analysis undertaken is
important because different types of analyses take into account different
types of costs and benefits. The specific types of costs and benefits
considered can, in turn, affect a study’s conclusions. Since the completion
of the 1999 study, changes at IRS and the lockbox network could affect
processing and the related costs. Because of these changes, the 1999 study
will not be useful for determining whether IRS and FMS should continue
using lockbox banks to process tax receipts when the current lockbox
agreements expire in 2007.

We are making recommendations to improve both oversight of and internal
controls at lockbox banks. We are also recommending that FMS and IRS
thoroughly review the results of the ongoing TIGTA investigation of the
2001 incident at the Pittsburgh lockbox site and that they implement
additional controls and revise the agreements as necessary to decrease the
likelihood that such an incident will occur again. Because IRS and FMS will
need to decide before 2007 whether to continue using lockbox banks to
process tax receipts, we are recommending that a study be done in time to
support this decision, that the type of study be clearly defined, and that all
appropriate costs be considered. FMS and IRS agreed with our
recommendations and have initiated or plan to initiate actions to
implement them.




Page 5                                             GAO-03-299 IRS Lockbox Banks
Background   In an effort to expedite receipt processing,4 the IRS conducted its first pilot
             project to obtain lockbox services from a commercial bank in 1984. The
             receipts processed were limited to tax receipts for estimated tax payments,
             which are typically paid by taxpayers on a quarterly basis. The bank was
             compensated from the interest it earned on a compensating balance—
             funds placed in the bank’s account by FMS. Since that time, the IRS
             lockbox program has expanded to cover taxpayers in all states and receipts
             for individual income tax returns, employment tax returns, and other
             miscellaneous types of taxes. Most of the returns are received during the
             April peak processing period and the smaller peak periods during January,
             June, and September. Certain taxpayers who owe money and are making
             payments are instructed to mail returns and payments to post office boxes
             maintained by the lockbox banks. The lockbox sites deposit the receipts to
             an account with Treasury and send processed documents (tax return forms
             and payment vouchers), computer tapes containing taxpayer data, and
             unprocessable receipts5 to IRS Submission Processing Centers for further
             processing and recording in the taxpayer accounts (see fig. 1).




             4
              Lockbox collection services are recognized by 31 U.S.C. 3720(a) as a procedure executive
             agencies may use to comply with requirements for the collection and timely deposit of
             funds.
             5
              Unprocessable receipts are tax receipts that lack adequate information, such as taxpayer
             identification numbers, to be processed by the lockbox bank and are forwarded to IRS
             Submission Processing Centers for further research.




             Page 6                                                     GAO-03-299 IRS Lockbox Banks
Figure 1: Flow of lockbox collections and dataFMS formalized the lockbox


     Taxpayer                    Post Office Box                 Lockbox Bank                     Federal Reserve
                                                                                                       Bank

                       Money                          Money                        Money



                        Data                           Data




                                                    Data           Data




                                                                                           Data




                                  Financial Management               Internal Revenue                Update taxpayer
                                         Service                          Service                       accounts
Source: GAO, based on Department of the Treasury, Financial Management Service, Cash Management Made Easy (Washington, D.C.:
April 2002). Some images copyright 1998 Nova Development Corporation.




FMS formalized the lockbox processing arrangements in 1993 by
establishing contractual agreements with commercial banks to process tax
receipts on behalf of IRS. In 2002, new, but similar, agreements were
established. Like the 1993 agreements, the 2002 agreements are 5-year
agreements with two 1-year extension options.6 The current lockbox
network consists of four banks, three of which operate multiple sites that




6
 The lockbox agreements entered into in 1993 took effect in calendar year 1994. The
agreements had 5-year terms and allowed for two 1-year extensions. After both 1-year
extensions were exercised, the agreements were extended by FMS for an additional 8
months.




Page 7                                                                            GAO-03-299 IRS Lockbox Banks
support the 10 IRS Submission Processing Centers across the country.7 The
agreements with FMS require that these banks operate their sites according
to IRS’s Lockbox Processing Guidelines (LPG). The LPGs provide the
detailed procedures the banks are required to follow in providing lockbox
services for IRS and are updated as needed. Both FMS and IRS monitor
lockbox bank compliance with the agreements and the LPGs, and each
lockbox site has an IRS employee who serves as a lockbox coordinator.8
For fiscal year 2002, IRS lockbox banks processed more than 66 million
receipts, totaling about $268 billion, which accounted for approximately 13
percent of total tax receipts in dollars and 32 percent in volume.




7
 The four banks operate at a total of nine locations. Because two of the locations have 2
sites each—1 for individual returns and 1 for business returns—there are a total of 11
lockbox sites.
8
 Each lockbox site is assigned a lockbox coordinator from the IRS Submission Processing
Center for which it processes tax payments. The coordinator is primarily responsible for
ensuring that his or her designated lockbox promptly deposits tax payments. The
coordinator is also responsible for performing compliance and quality reviews and for
coordinating lockbox oversight and operating activities between lockbox management,
FMS, and IRS National Office and the Submission Processing Center.




Page 8                                                      GAO-03-299 IRS Lockbox Banks
Figure 2: Fiscal Year 2002 Dollar Value and Volume of Collections for Three Major Types of Tax Receipt Collection Mechanisms


                         Dollars                                                        Volume




                                          $86 billion                                                               32.6 million

                                          $268 billion                                                              66.8 million
                                          $1.57 trillion                                                            66.0 million




                                               IRS Submission Processing Center collection

                                               Lockbox collection

                                               Electronic Federal Tax Payment System

     Source: IRS data.


                                          Note: These pie charts exclude 46.1 million and almost $80 billion of receipts related to Federal Tax
                                          Deposits (Coupons) in fiscal year 2002.


                                          The intent of the lockbox program is to enhance federal cash management
                                          by accelerating the deposit of tax receipts, which would increase interest
                                          float savings (or interest cost avoidance) to the government and reduce the
                                          amount Treasury would have to borrow to pay government obligations. The
                                          estimate of interest float savings resulting from IRS’s use of lockbox banks
                                          has varied throughout the years. In calculating interest float savings, IRS
                                          and FMS assumed, based on a 1988 joint IRS/FMS study,9 that lockbox
                                          banks could process receipts and deposit the funds to a Treasury account 3
                                          days faster than IRS. However, in a 1998 report, the Treasury Office of
                                          Inspector General (OIG) questioned the validity of this assumption and
                                          recommended that IRS acquire relevant and reliable comparative cost data



                                          9
                                           U.S. Department of the Treasury, Internal Revenue Service, Evaluation of Alternative
                                          Systems for Collecting Form 1040 Estimated Tax Payments (Washington, D.C.: May 1988).




                                          Page 9                                                             GAO-03-299 IRS Lockbox Banks
              on all aspects of the lockbox program to identify the most cost-effective
              option to use for processing and depositing tax receipts.10

              In response to the Treasury OIG report, IRS and FMS hired a contractor to
              compare lockbox bank processing to IRS processing for individual tax
              (Form 1040) receipts. The contractor reported in July 1998 that lockbox
              banks could make funds available to the federal government an average of
              2 days faster than IRS. In 1999, IRS and FMS formed a taskforce to study
              the costs and benefits of continuing to use lockbox banks for processing
              Form 1040 receipts. Based on its study, the IRS/FMS taskforce
              recommended that such processing remain with the lockbox banks rather
              than be returned to IRS for fiscal years 2001-2007.11



Scope and     To accomplish our work, we reviewed reports relevant to oversight and
              management of the lockbox program, including reports prepared by FMS,
Methodology   IRS, GAO, the Treasury OIG, TIGTA, and internal and external auditors
              from several lockbox banks. We reviewed laws, regulations, and guidance
              related to the cash management activities of the federal government. We
              also interviewed FMS and IRS officials from several headquarters divisions.
              As agreed with your office, we did not review the incident involving the
              loss and destruction of taxpayer receipts and data at the Pittsburgh
              lockbox, since an ongoing investigation was in process. The following
              procedures were also performed for each of the objectives:

              • To determine if new contractual agreements address previously
                identified problems and correct provisions that could contribute to
                improper handling of taxpayer returns, we reviewed and analyzed the
                provisions in the 1993 and 2002 lockbox bank contractual agreements.
                We also compared the agreements to determine whether changes had
                been made.

              • To determine the adequacy of FMS’s and IRS’s oversight of lockbox
                banks, we reviewed FMS and IRS policies, guidelines, checklists,


              10
               U.S. Department of the Treasury, Office of Inspector General, Review of the Effectiveness
              of Using Commercial Bank Lockboxes for Federal Income Tax Payments, OIG-98-097
              (Washington, D.C.: Aug. 20, 1998).
              11
               IRS/FMS Joint Taskforce, 1040 Tax Payment Comparative Cost Benefit Study
              (Washington, D.C.: August 1999).




              Page 10                                                    GAO-03-299 IRS Lockbox Banks
     schedules of site visits, and reports from oversight reviews. We
     performed site visits at two IRS Submission Processing Centers to
     observe IRS reviews of documentation received from the lockbox
     banks. At each Submission Processing Center, we interviewed relevant
     management and staff concerning lockbox bank oversight policies,
     procedures, and practices.

• To determine if lockbox banks’ security and internal controls to
  safeguard taxpayer receipts and returns are sound and properly
  implemented, we observed physical security and internal controls and
  interviewed lockbox personnel at all nine lockbox locations during the
  April 2002 peak processing period and at two lockbox sites during the
  June 2002 peak processing period. At each site, we also reviewed
  lockbox bank employee personnel records for a nonrepresentative
  selection of permanent and temporary lockbox employees. In addition,
  we compared the 2001 and 2002 LPGs for changes related to
  safeguarding tax receipts and data, receipt processing, employee
  screening, and courier requirements. We also compared IRS’s Internal
  Revenue Manual (IRM)12 and other directives, which are IRS’s detailed
  policies, with the 2002 LPGs.

• To determine whether the costs and benefits of processing tax receipts
  through lockbox banks instead of processing them at IRS were
  considered, we reviewed federal guidance and economic literature on
  cost-benefit and cost-effectiveness analyses of federal programs and
  policies. In addition, we analyzed prior FMS and IRS studies and the
  support for the data, assumptions, and methodology used in the 1999
  report to estimate the costs and benefits of processing tax receipts
  through lockbox banks versus processing them at IRS.

We performed our work from April 2002 through November 2002 in
accordance with U.S. generally accepted government auditing standards.
We requested written comments on a draft of this report from the Secretary
of the Department of the Treasury or his designee. These comments are
discussed in the Agency Comments and Our Evaluation section of this
report, incorporated in the report as applicable, and reprinted in appendix
III.



12
 The IRM is IRS’s internal operating manual that sets forth the agency’s various operating
policies and procedures.




Page 11                                                     GAO-03-299 IRS Lockbox Banks
It Is Not Known             We found nothing inherent in the new 2002 lockbox bank contractual
                            agreements or the prior agreements that would necessarily contribute to
Whether Contract            mishandling of taxpayer receipts. The agreements contain penalty
Provisions Could            provisions that can result in negative consequences if banks do not perform
                            work that meets quality standards or do not perform work within required
Contribute to Improper      time frames. The consequences range from financial penalties to
Handling of Taxpayer        termination of the lockbox agreement. Although a desire to avoid negative
Receipts                    consequences could motivate lockbox bank employees to make poor
                            decisions in their handling of taxpayer receipts, the penalty and
                            termination provisions are necessary to help the federal government
                            address inadequate contractor performance on the two performance
                            dimensions—quality and timeliness—deemed critical by IRS and FMS.

                            FMS and IRS made some enhancements to the 2002 agreements, such as
                            the addition of a new performance penalty and clarification of other
                            provisions. Because TIGTA’s investigation of the incident involving the loss
                            and destruction of tax receipts by employees at the Pittsburgh lockbox site
                            during the 2001 April peak processing period is still ongoing, it is unclear
                            whether any provisions in the lockbox agreements may have contributed to
                            the mishandling incident. When the results of the investigation are known,
                            FMS and IRS should determine whether contract provisions need to be
                            modified or whether additional controls need to be implemented.



Lockbox Bank Agreements     Factors used to assess contractor performance are cost, timeliness, and
Contain Timeliness and      quality of service provided. Contracts often contain specific standards for
                            acceptable performance as well as provisions for rewarding or penalizing
Quality Factors to Assess   contractors according to their performance in these areas. Such provisions
Performance                 may inadvertently encourage contractors to focus their efforts on one area
                            to the detriment of their performance in other areas. For example, if a
                            contract’s provisions reward timely performance more than they reward
                            high-quality performance, contractors may be encouraged to take shortcuts
                            that improve timeliness but detract from quality of work. As a result, it is
                            important that contract incentives be appropriately designed and balanced
                            to obtain acceptable levels of performance in all relevant areas. To ensure
                            that contract provisions are operating as intended, effective oversight of
                            contractors is essential.

                            The lockbox banks are paid a fixed price for each item they process, and
                            their total compensation depends on the number of each type of receipt
                            they process. Lockbox banks have no direct influence over the volume of



                            Page 12                                           GAO-03-299 IRS Lockbox Banks
receipts. The compensation paid is therefore not a factor in measuring IRS
lockbox performance, and the lockbox contractual agreements contain no
direct incentives, positive or negative, related to cost. Lockbox bank
performance is measured on timeliness and quality factors, specifically
focusing on expediting the flow of funds to Treasury and ensuring that
receipts are accurately processed.

Because the basis for using lockbox banks was IRS’s and FMS’s belief that
the banks could process tax receipts faster than IRS could, timeliness is a
key measure of lockbox bank performance. Except during peak processing
periods, the agreements require that lockbox banks deposit receipts within
24 hours of their receipt at the lockbox bank. During peak processing
periods, all receipts must be processed and ready for deposit by the
assigned program completion date (PCD). 13 According to the terms of the
lockbox contractual agreements, FMS may assess banks penalties or
terminate their contractual agreements if they fail to meet these deadlines.
The agreements also provide that the amount of any penalty assessed for
late deposit of tax receipts shall be based on the amount of interest
Treasury lost because of the delay. FMS imposed financial penalties on two
lockbox banks for not meeting the PCD during the April 1997 peak
processing period.

Meeting quality standards is another critical aspect of IRS lockbox banks’
performance. Processing errors can place unnecessary burdens on
taxpayers and delay processing of tax receipts. For example, a processing
error might cause a lockbox bank to withdraw more funds from a
taxpayer’s account than the amount actually written on the check. If the
taxpayer’s account contained inadequate funds to cover the incorrect
withdrawal amount, the taxpayer’s bank could assess penalties for
insufficient funds. If the error caused the bank to withdraw less than the
amount owed, IRS might erroneously assess the taxpayer interest and
penalties for an incomplete payment. The lockbox agreement provisions
allow FMS to assess lockbox banks financial penalties or to terminate an
agreement for poor performance. FMS added a new provision to the 2002
lockbox agreements that is designed to facilitate reimbursement to IRS and
FMS for costs they incur due to specific failures in performance, such as



13
 The program completion date is the date by which the banks must finish processing all tax
receipts associated with the April peak processing period and when they return to the
nonpeak workload requirement to process each receipt within 24 hours of receiving it.




Page 13                                                    GAO-03-299 IRS Lockbox Banks
                             costs resulting from lockbox banks’ errors in processing tax receipts. In
                             addition, the 2002 agreements clarified certain existing penalty provisions.

                             We found nothing inherent in the 1993 or 2002 lockbox contractual
                             agreements that would necessarily contribute to mishandling of taxpayer
                             receipts. Although a desire to avoid negative consequences, such as
                             financial penalties or contract termination, could cause lockbox bank
                             employees to make poor decisions, penalty and termination provisions are
                             necessary to help the federal government address inadequate contractor
                             performance. To help ensure that contractors are adhering to contract
                             terms and to reduce the risk that lockbox banks might compromise
                             taxpayer data, effective oversight of lockbox sites is essential.



Cause of the 2001 Incident   The exact cause of the 2001 incident involving the loss and destruction of
Remains Under                taxpayer data and receipts at the Pittsburgh lockbox site has yet to be
                             officially reported. The site had a history of performance problems for
Investigation                which the bank had been assessed financial and other penalties. In 1997,
                             FMS assessed the bank that operated the Pittsburgh site more than $1.4
                             million in penalties for failing to meet the assigned PCD and therefore
                             delaying availability of funds to the Treasury. In September 2000, FMS
                             placed the site on probation because of numerous uncorrected security
                             violations, including commingling of corporate and other government
                             agency processing with IRS processing. FMS, with IRS’s concurrence,
                             removed the site from probationary status 2 ½ months later, after a site
                             review conducted during the probationary period indicated that bank
                             management had corrected all but one of the security violations.14 A
                             subsequent, unannounced review by FMS and IRS 3 ½ months after the site
                             was taken off probation also found that past violations of security
                             requirements had not recurred and that the site was, for the most part, in
                             compliance with security requirements. Nevertheless, approximately 2
                             months after this review, the Pittsburgh site was found to have lost or
                             destroyed tens of thousands of tax returns, and, as a result, FMS
                             terminated its contractual agreement for the site. As of September 30, 2002,
                             IRS had spent over $4 million to obtain duplicate receipts and returns from



                             14
                               One violation remained, which was to be corrected when the bank moved into a new
                             facility in December 2000.




                             Page 14                                                  GAO-03-299 IRS Lockbox Banks
                       the affected taxpayers, and the federal government had lost an estimated
                       $13.5 million in interest as a result of the incident.

                       In October 2002, Mellon Bank agreed to pay the government $18.1 million
                       to cover administrative costs and expenses associated with the incident.
                       However, TIGTA is still investigating the incident to determine whether
                       criminal charges should be filed against any of the bank employees. As of
                       November 2002, TIGTA and the applicable U.S. Attorney’s Office were
                       unable to discuss this investigation with us. Until the investigation is
                       completed, we cannot determine whether the site’s interpretation of
                       contract provisions was a contributing factor to the 2001 incident or
                       whether provisions need to be added or revised to help prevent a similar
                       incident from occurring.



Oversight of Lockbox   FMS and IRS oversight of lockbox bank operations is a key control for
                       ensuring that funds collected through the lockbox banks are protected
Banks Was Not Fully    against fraud and mismanagement. The oversight functions performed by
Effective              FMS and IRS include various on-site and off-site reviews to ensure
                       compliance with LPGs and contract terms, evaluation of requests for
                       waivers from LPG requirements and proposed compensating controls, and
                       enforcement of penalties against banks that fail to meet LPG and contract
                       terms. In calendar year 2002, the agencies made significant improvements
                       to their oversight of lockbox operations, mostly in response to the
                       Pittsburgh lockbox incident. However, we found that the oversight of
                       lockbox banks was not fully effective in protecting the government’s
                       interests due to (1) a lack of clear directives and documented policies and
                       procedures for various oversight functions, (2) key oversight functions not
                       being performed, and (3) conflicting roles and responsibilities for IRS
                       lockbox coordinators. These issues reduce the overall effectiveness of IRS
                       and FMS oversight of lockbox banks. Additionally, the lack of clearly
                       defined oversight requirements increases the risk that the oversight
                       improvements made during 2002 may not continue in the future. According
                       to IRS officials, they are in varying stages of completing several
                       memoranda of understanding to identify and document oversight roles and
                       responsibilities. Until these roles and responsibilities are agreed to and
                       documented, however, oversight weaknesses are likely to continue to exist.




                       Page 15                                          GAO-03-299 IRS Lockbox Banks
FMS and IRS Improved         FMS and IRS made significant improvements to the oversight of lockbox
Oversight in 2002 but Have   banks in 2002 compared with prior years. These improvements include (1)
                             enhanced monitoring of peak processing operations, (2) involvement of
Not Incorporated
                             key IRS officials in security reviews, (3) establishment of a new office with
Improvements in Agency       a full-time FMS official responsible for oversight of lockbox security, and
Policies and Procedures      (4) establishment of a new performance penalty provision to reimburse the
                             government for poor quality performance. However, many of the
                             improvements have not yet been institutionalized in the form of agency
                             policies and procedures. As such, there is less assurance that this increased
                             oversight will continue in the future.

Monitoring of Peak Period    Prior to 2002, FMS’s on-site presence during peak processing periods was
Operations Was Enhanced      limited to only a few days each year and occurred near the end of the peak
                             periods to ensure that production goals were achieved. IRS’s on-site
                             presence at lockbox banks was generally limited to a lockbox coordinator,
                             who was present for the duration of the peak period. However, these
                             coordinators face competing demands of ensuring that lockbox sites
                             promptly deposit tax payments, performing quality and compliance
                             reviews, and assisting with other processing issues, such as training
                             lockbox staff.

                             In reaction to the Pittsburgh incident, FMS and IRS concluded that they
                             needed more on-site presence at lockbox banks during peak operations. In
                             April 2002, each lockbox site had at least one FMS official, one IRS
                             headquarters official, and the site’s designated lockbox coordinator present
                             for the entire April peak processing period. This increased on-site presence
                             provided IRS and FMS with more comprehensive coverage of April peak
                             operations.

                             During 2002, FMS and IRS also placed a heavier emphasis on monitoring
                             lockbox sites’ daily production status. According to IRS and FMS officials,
                             their focus historically has been on monitoring a lockbox site’s ability to
                             meet the overall April peak processing period’s PCD. IRS and FMS found
                             that this approach presented problems because lockbox banks tended to
                             address production problems during the peak processing period only when
                             meeting the PCD was questionable. The solution employed by the banks
                             was to bring in additional temporary staff near the end of the peak period
                             to be able to meet the PCD. FMS and IRS officials indicated that their
                             limited on-site presence affected the agencies’ ability to detect production
                             problems on a real-time basis. Only after the peak period did the lockbox
                             banks bring production issues to the attention of IRS and FMS.



                             Page 16                                           GAO-03-299 IRS Lockbox Banks
                                 In 2002, FMS and IRS officials focused on monitoring lockbox banks’ daily
                                 production by reviewing production reports, observing production activity
                                 on the processing floor, and reporting production issues to IRS and FMS
                                 headquarters as soon as issues arose. During April 2002 and subsequent
                                 smaller peak periods in June and September 2002, each lockbox site also
                                 submitted, on a daily basis, an “FMS Daily Status Report.” These reports
                                 noted the daily status of critical production issues, such as staffing
                                 shortages and equipment problems, that could cause delays in the timely
                                 deposit of tax receipts or could affect performance. FMS and IRS
                                 headquarters officials reviewed these reports for potential problems and
                                 contacted lockbox management and on-site agency officials for follow-up
                                 and to facilitate timely resolutions of the problems.

                                 While these changes enhanced monitoring of peak operating periods, these
                                 improvements have not yet been incorporated into agency policies.
                                 Currently, only the lockbox coordinator is required by IRS policies to be
                                 on-site during the peak processing period. Personnel from FMS and IRS
                                 headquarters are not mandated by agency policies to be at lockbox sites
                                 during this time. Additionally, IRS officials indicated that they might not
                                 have adequate headquarters staff to assist with future on-site reviews. As a
                                 result, there is less assurance that increased on-site presence of staff at
                                 lockbox sites during peak processing periods will continue.

IRS Personnel with Physical      After the 2001 Pittsburgh incident, IRS concluded that its participation in
Security Expertise Now Perform   joint IRS/FMS annual unannounced security reviews should be performed
Security Reviews                 by IRS staff with security expertise. Prior to 2002, personnel from IRS’s
                                 Wage and Investment Division, who have primary responsibility to manage
                                 the lockbox program, performed physical security reviews but did not have
                                 physical security expertise. During 2002, IRS’s Agency-Wide Shared
                                 Services (AWSS), which has staff with physical security expertise and
                                 performs physical security reviews at IRS Submission Processing Centers,
                                 began participating in the joint IRS/FMS unannounced security reviews.
                                 However, IRS policies only require the Wage and Investment Division to
                                 perform unannounced security reviews. AWSS’s participation in lockbox
                                 reviews is based only on an oral agreement to perform such reviews. As
                                 such, there is less assurance that AWSS will continue to perform lockbox
                                 security reviews in the future.

FMS Established the Bank         Prior to 2002, FMS’s Financial Services Division (FSD), which had the
Review Office                    administrative responsibility for negotiating and entering into lockbox
                                 contracts with financial institutions, also had the responsibility to oversee
                                 lockbox banks’ compliance with contract terms, such as security



                                 Page 17                                            GAO-03-299 IRS Lockbox Banks
                          requirements. To effectively perform its oversight responsibilities, FMS
                          recognized a need to establish a full-time position responsible for oversight
                          of lockbox security. In August 2002, FMS formally established the Bank
                          Review Office. The director and staff of this office are now responsible for
                          FMS’s oversight of the security of federal government lockbox banks. Their
                          responsibilities now include performing on-site reviews, following up on
                          corrective actions to address review findings, and reviewing the adequacy
                          of security requirements for lockbox banks. The director of this office now
                          serves as the main FMS contact point on most oversight issues for IRS and
                          lockbox banks.

New Performance Penalty   A new provision was added to the 2002 contractual agreements to assist the
Provision Established     government in obtaining reimbursement from lockbox banks for direct
                          costs incurred by IRS to correct performance failures on the part of
                          lockbox banks. This provision enhances the government’s ability to
                          penalize lockbox banks for poor quality work and be reimbursed for the
                          additional costs IRS incurs to rework transactions erroneously processed
                          by lockbox banks. Effective use of this provision requires additional
                          guidelines and procedures to help management decide whether certain
                          situations merit pursuing the penalty provision. Such guidelines and
                          procedures should include (1) IRS’s expectations for unacceptable error
                          rates, (2) procedures to identify and document lockbox errors, and (3)
                          procedures to track IRS costs incurred as a result of rework.

                          During 2002, IRS had not established guidelines and procedures for
                          effective use of the new performance penalty provision. IRS cited three
                          reasons why guidelines and procedures had not yet been established. First,
                          IRS has not yet determined thresholds for unacceptable error rates.
                          Second, IRS officials indicated that the agency had spent significant
                          resources to document and build a legally defensible case to obtain
                          reimbursement of costs related to the 2001 incident. Based on lessons
                          learned from this case, IRS concluded that it needed to establish a more
                          cost-effective means to accurately identify and document lockbox errors,
                          as opposed to errors caused by taxpayers or IRS. During 2001, IRS tested a
                          process to identify and document lockbox errors but concluded that the
                          process was too labor-intensive and might not provide accurate and legally
                          defensible data. Therefore, IRS is still exploring other methods to obtain
                          these data. Finally, IRS officials explained that by law, reimbursements
                          from lockbox banks would have to be remitted to the U.S. Treasury general
                          fund and that they had explored legal options to keep the reimbursed funds
                          for IRS’s own use.




                          Page 18                                           GAO-03-299 IRS Lockbox Banks
                           The reimbursement provision is a critical tool available to the government
                           as a means to recover from lockbox banks costs incurred as a result of
                           poor quality work and as an enforcement tool to encourage banks to
                           implement effective controls and procedures to accurately process
                           receipts. However, until the necessary guidelines and procedures are
                           established, IRS and FMS cannot effectively use this oversight tool. As a
                           result, the government may be paying for poor quality work and incurring
                           additional costs to correct errors.



FMS and IRS Did Not        Despite significant improvements, we found several instances where key
Perform Certain Key        oversight functions were not performed, which resulted in an increased
                           risk of loss to the government and taxpayers. Specifically, (1) IRS and FMS
Oversight Functions
                           did not take timely action on lockbox sites’ requests for waivers from LPG
                           requirements, (2) IRS did not always participate in unannounced security
                           reviews, (3) FMS did not always obtain formal responses from lockbox
                           bank management to unannounced security reviews, and (4) IRS lockbox
                           coordinators did not always complete reviews for peak processing periods.
                           Additionally, the guidance used for these reviews needs to be strengthened.

IRS and FMS Did Not Take   The LPGs set forth security and processing requirements for lockbox sites.
Timely Action on Formal    They also allow deviations from these requirements if bank management
Requests for Waivers       submits a written waiver request to IRS and FMS. The bank must
                           demonstrate its site’s legitimate inability to meet a requirement and must
                           implement an alternate procedure or compensating control. In practice,
                           after a bank submits a written waiver request stating the reason for its site’s
                           inability to meet the LPG requirement and explaining its compensating
                           control to mitigate risks of loss to the government, IRS and FMS allow the
                           site to operate with its compensating control while they review the waiver
                           request. However, because some waiver requests will eventually be denied
                           after FMS and IRS conclude that the compensating controls are not
                           adequate, some sites with inadequate controls are, in effect, allowed to
                           operate in noncompliance with the LPGs until their waiver is officially
                           denied. Therefore, to protect the government from losses resulting from a
                           site’s noncompliance, FMS and IRS have a fiduciary duty to approve or
                           disapprove waiver requests and effectively and promptly communicate
                           final decisions.

                           Prior to April 2002, IRS and FMS approved and disapproved waiver
                           requests orally. To better coordinate their efforts, the agencies decided to
                           develop a written joint process to assess waiver requests in April 2002.
                           However, this process was never formalized in agency policies. IRS



                           Page 19                                             GAO-03-299 IRS Lockbox Banks
provided us a draft document of the joint waiver assessment process.
According to the draft document, lockbox banks would submit a waiver
request form to FMS. FMS would assess the waiver request and forward the
request with FMS’s recommendations to an IRS waiver coordinator. The
IRS waiver coordinator would disseminate the waiver requests to various
units within IRS responsible for assessing the waiver requests. Once
appropriate IRS officials had made their decisions and signed off on the
waiver forms, the IRS waiver coordinator would forward the waiver form
with IRS’s decision to FMS. FMS would notify the bank of the joint decision
by returning the waiver request form with both agencies’ responses. The
draft document indicates that the whole process should take about 6 days
from FMS’s receipt of the waiver request form.

According to our review of waiver requests made from April 16 through
April 22, 2002, FMS forwarded to IRS its recommendations on most of the
requests within 5 days of receiving them from lockbox banks. However, IRS
took 5 months to officially sign half of the waivers. According to IRS
officials, this delay resulted from a misunderstanding on the part of some
IRS officials about whether IRS had to complete the waiver forms if IRS
had already orally informed FMS of its decision. FMS postponed notifying
the banks of a decision on their requests because it was waiting to receive a
formal written decision from IRS for each request. However, 4 months after
FMS received the requests for waivers and with no official decision from
IRS, FMS decided to inform the lockbox sites of its unilateral disapproval
of the banks’ waiver requests to mitigate the risk of loss to the government
from lockbox sites not operating in compliance with the LPGs.

Although most of the waiver requests were not related to critical
requirements, one lockbox waiver pertained to a critical LPG security
requirement. Under this requirement, temporary employees must provide
photo identifications to the guards in exchange for badges allowing them
access to the processing area. This control procedure was designed to
validate the identity of individuals claiming to be employees before they
enter the processing area. Bank management at one lockbox bank believed
that its automated entry system provided adequate compensating controls
against unauthorized access to tax data and receipts and that the manual
verification of each employee’s identity was unnecessary. The bank
therefore did not perform the procedure. FMS and IRS eventually denied
the request, stating that the lockbox bank’s compensating controls did not
provide sufficient protection against unauthorized entry. However, because
of the breakdown in the joint waiver assessment process and the resulting
delay in notifying the bank of the agencies’ decision, tax receipts and data



Page 20                                           GAO-03-299 IRS Lockbox Banks
                                 were unnecessarily exposed to an increased risk of theft. Bank
                                 management had informally requested a waiver for the same issue in
                                 August 2001, before FMS and IRS established their formal waiver process
                                 in April 2002. IRS officials indicated that they had already orally informed
                                 the bank that its initial request for a waiver was denied and had also
                                 informed FMS during a meeting that the subsequent request submitted on
                                 the official waiver request form in April 2002 was denied. Therefore, IRS
                                 officials concluded that it was not necessary to review the April 2002
                                 formal waiver request. FMS postponed notifying the banks of the decision
                                 because it was waiting for IRS’s decision in writing. After FMS decided to
                                 inform banks of its unilateral decisions on their formal waiver requests, it
                                 notified this site of its decision to deny the waiver request in mid-August
                                 2002. As a result, the site operated in noncompliance with this security
                                 requirement for over 7 months, from January through August 2002. This
                                 period included the April 2002 peak period, when the bank operated in
                                 three shifts with as many as 300 employees per shift. IRS and FMS officials
                                 indicated that they are developing several memoranda of understanding
                                 between the two agencies to better coordinate oversight efforts, including
                                 the joint waiver assessment process.

IRS Did Not Always Participate   In response to a Treasury OIG recommendation,15 IRS and FMS began
in Unannounced Security          performing unannounced security reviews of lockbox bank sites. IRS’s IRM
Reviews                          requires its Wage and Investment Division to conduct joint unannounced
                                 security reviews with FMS. However, IRS did not participate in the first
                                 three unannounced security reviews in 2002. The IRS official who would
                                 have participated in these security reviews had an extensive technical
                                 background in physical security, which would have been helpful in
                                 detecting physical security deficiencies. According to IRS officials, IRS did
                                 not participate in the reviews because the units responsible for performing
                                 various security reviews for both agencies were reorganizing during early
                                 2002 and the agencies had failed to effectively communicate who would be
                                 the responsible parties to perform the unannounced security reviews. IRS
                                 officials indicated that they plan to include coordination of security
                                 reviews between the two agencies in a memorandum of understanding
                                 currently being developed.




                                 15
                                      OIG 98-097.




                                 Page 21                                           GAO-03-299 IRS Lockbox Banks
FMS Did Not Always Obtain     Effective oversight of lockbox banks requires appropriate follow-up on
Responses from Lockbox Bank   corrective actions taken to address deficiencies found during on-site
Management to Unannounced     reviews. As part of its follow-up procedures, FMS requires lockbox bank
Reviews                       management to provide an official management response to reports on its
                              unannounced reviews. In their response, bank managers are to indicate
                              whether corrective actions have been taken or propose corrective actions
                              and the dates by which the bank intends to implement them. Personnel
                              from FMS’s FSD are responsible for obtaining management responses.
                              However, FSD failed to obtain formal management responses for three
                              unannounced security review reports issued in 2001 because FSD staff
                              were preoccupied with the Pittsburgh lockbox incident and with
                              implementing the 2002 lockbox network. Additionally, the tracking
                              procedure in place to remind staff to obtain management responses was
                              ineffective. As a result, FMS did not have sufficient information to assess
                              the adequacy or timeliness of proposed corrective actions or corrective
                              actions already taken.

                              FMS and IRS found the same security problems identified by these reviews
                              several months later. Although two of the three locations had closed after
                              2001, bank managers from one of the closed locations were transferred to
                              manage a new lockbox location in the 2002 lockbox network. In a
                              subsequent visit to this new location, FMS found the same security
                              violation that it had found in 2001 at the closed site regarding the lack of a
                              seeding program.16 Additionally, a subsequent visit by FMS and IRS to the
                              location that continued to operate in 2002 revealed problems with
                              malfunctioning perimeter door alarms that were similar to problems
                              identified during the previous unannounced security review. The lack of
                              effective controls to ensure that bank managers take corrective actions
                              increases the risk that identified security weaknesses will not be corrected.
                              According to FMS officials, the recently created Bank Review Office,
                              whose staff have full-time responsibility for security oversight, is now
                              responsible for following up on management responses to security reviews.
                              Additionally, FMS officials indicated that they plan to create an automated
                              tracking system to better track the status of management responses.


                              16
                               A seeding program is a control procedure used by bank management to discourage and
                              detect employee theft. Bank managers or TIGTA place cash or checks with blank payee
                              names among IRS tax payments without the employees’ knowledge and closely monitor
                              employees to determine whether they steal the cash or checks or promptly report their
                              discovery to bank managers.




                              Page 22                                                  GAO-03-299 IRS Lockbox Banks
Lockbox Coordinators’ Reviews   The IRM specifically directs lockbox coordinators to perform on-site
Were Not Adequately Performed   reviews of lockbox banks during peak processing periods. The scope of
                                these on-site reviews includes assessments of the lockbox site’s
                                compliance with critical processing and security requirements. Lockbox
                                coordinators record the results of their reviews on forms specifically
                                designed to show results of observations and sampling of transactions to
                                determine the lockbox site’s compliance with specific security and
                                processing requirements.

                                However, for the January and April 2002 peak processing periods, lockbox
                                coordinators did not adequately perform these reviews. Specifically,
                                coordinators did not perform reviews for four lockbox sites for the January
                                2002 peak processing period. In addition, some of the information to be
                                recorded on the forms used by the coordinators to document their reviews
                                was not provided. For the April 2002 peak period, all the coordinators
                                submitted the results of their reviews, but some of the reviews and the
                                forms used to document them were only partially completed. IRS officials
                                explained that the reviews could not be completed because several
                                lockbox sites were new to the lockbox network during 2002 and therefore
                                required full-time support from their lockbox coordinators. Because the
                                reviews were not always completed, IRS may not have detected instances
                                of noncompliance and therefore would not have been able to take
                                immediate corrective actions.

                                The guidelines for the reviews conducted by lockbox coordinators also
                                need to be strengthened. To provide adequate oversight of lockboxes,
                                lockbox coordinator reviews should include steps to assess critical
                                controls and procedures for lockbox security and processing. In general,
                                the lockbox coordinators’ reviews provide coverage for most of these
                                areas. However, we found other critical controls and procedures not
                                sufficiently covered by lockbox coordinator reviews because the guidelines
                                and review procedures were either unclear or did not require these
                                controls and procedures to be subject to review. These deficiencies could
                                lead to IRS’s failure to detect significant instances of noncompliance.

                                For example, while TIGTA found that couriers with criminal records at one
                                lockbox location were given access to taxpayer data before their FBI
                                fingerprint checks were completed, the lockbox coordinator’s review
                                found the same location to be in compliance with courier requirements. We
                                found that there is no specific step in the lockbox coordinator review
                                procedures to determine whether all couriers given access to taxpayer data
                                have completed favorable FBI fingerprint checks, as required by the LPGs.



                                Page 23                                          GAO-03-299 IRS Lockbox Banks
                           The review procedures only broadly ask whether the courier service is in
                           compliance with the LPGs. Additionally, while the review procedures
                           require coordinators to sample employee files to determine lockbox
                           compliance with FBI fingerprinting requirements, there is no similar review
                           step to determine lockbox compliance with FBI fingerprint checks for
                           couriers and contractors. Lockbox coordinators we interviewed stated that
                           during their on-site reviews, they did not verify whether couriers had
                           completed favorable FBI fingerprint checks before they were given access
                           to taxpayer data.

                           As discussed later in this report, we also found problems with some
                           lockbox sites’ controls to account for cash payments received from
                           taxpayers and items found during candling.17 For example, the internal logs
                           used by some lockbox sites to record cash received and items found during
                           candling did not reconcile with the logs they submitted to IRS, raising
                           questions about possible missing payments. Lockbox coordinators did not
                           detect this problem because they are not required to and do not review
                           internal lockbox logs for cash payments and candled items.



Lockbox Coordinators’      IRS lockbox coordinators are responsible for the day-to-day administration
Conflicting Roles and      of the lockbox program, including providing guidance and training to
                           lockbox staff and ensuring that the lockbox banks promptly address
Responsibilities Could     production problems that may delay the deposit of funds to the Treasury.
Impair Their Objectivity   Lockbox coordinators are also responsible for performing on-site reviews
                           to assess work quality and the bank’s compliance with security
                           requirements. This creates a situation in which lockbox coordinators have
                           multiple and conflicting responsibilities.

                           When faced with competing demands, the likelihood increases that the day-
                           to-day pressures of administering the lockbox program will take
                           precedence over oversight responsibilities. For example, according to IRS
                           officials, the lockbox coordinators’ failure to complete their peak period
                           reviews resulted from competing demands. Lockbox coordinators are
                           responsible for performing quality reviews and for assisting lockbox banks
                           with processing issues. IRS Wage and Investment officials indicated that
                           some of the lockbox coordinators could not complete their reviews



                           17
                            Candling is a process that uses a light source to determine if any contents remain in
                           envelopes before their destruction. Items found during candling must be recorded on a log.




                           Page 24                                                    GAO-03-299 IRS Lockbox Banks
                      because more pressing matters concerning lockbox operations,
                      particularly at new lockbox sites, required most of their attention.

                      The close working relationship with bank management that lockbox
                      coordinators develop while helping bank management meet processing
                      goals could also impair coordinators’ objectivity and independence when
                      they are evaluating the bank’s compliance with LPG requirements. The
                      Treasury OIG raised this issue in 1998 when it recommended that
                      coordinators periodically rotate out of their coordinator positions to help
                      maintain independence. However, IRS has not yet addressed this issue,
                      citing its need to retain experienced lockbox coordinators to assist with the
                      implementation of the 2002 lockbox network. IRS officials indicated that
                      there are plans to reorganize positions of lockbox coordinators to address
                      the independence issue. Until this issue is addressed, IRS has no
                      independent overseers with sole responsibility for monitoring lockbox
                      bank compliance during peak processing periods.



Lockbox Banks’        The Comptroller General’s Standards for Internal Control in the Federal
                      Government18 require that access to resources and records, such as IRS
Internal Control      receipts and taxpayer data, be limited to authorized individuals to reduce
Deficiencies Expose   the risk of unauthorized use or loss to the government. Lockbox banks,
                      working as financial agents of the federal government, have a responsibility
the Federal           to protect taxpayer receipts and data entrusted to them. Tax receipts, such
Government to Theft   as cash and checks, are highly susceptible to theft, and unauthorized use of
and Loss              taxpayer data could result in identity theft and financial fraud.19 For
                      example, from October 1, 2000, to April 30, 2002, TIGTA initiated
                      investigations of theft of receipts valued at almost $2 million from the IRS
                      lockbox network.20 It is therefore critical that lockbox banks implement a
                      strong system of internal controls for the lockbox sites they operate.

                      Prior audits by GAO and TIGTA have noted internal control weaknesses at
                      lockbox sites. For example, in fiscal year 2000, we found that background


                      18
                       U.S. General Accounting Office, Standards for Internal Control in the Federal
                      Government, GAO/AIMD-00-21.3.1 (Washington, D.C.: November 1999).
                      19
                       Taxpayer data on tax forms could include taxpayer name, social security number, and
                      address.
                      20
                       This is in addition to the approximately $1.2 billion in receipts that were lost or destroyed
                      at the Pittsburgh site.




                      Page 25                                                       GAO-03-299 IRS Lockbox Banks
screening for a temporary lockbox employee’s criminal history was limited
to a local police records check and that some employees were given access
to taxpayer data and receipts before completion of their background
screening. We also found that lockbox couriers were subject to less
stringent standards than IRS couriers. For example, lockbox couriers were
not required to travel in pairs when transporting taxpayer data. We
reported that these control weaknesses could lead to thefts of taxpayer
receipts and data at lockbox banks.21

IRS and lockbox banks have implemented several additional safeguarding
controls in response to audit findings and the 2001 incident at the
Pittsburgh site. For example, IRS now requires lockbox employees to have
obtained favorable results on their FBI fingerprint checks, which are
nationwide checks of criminal records, before they receive access to tax
data. IRS has also enhanced lockbox courier security guidelines.
Nevertheless, during our recent visits to all nine lockbox locations, we
found internal control deficiencies in the areas of (1) physical security, (2)
processing controls, (3) courier security, and (4) employment screening.
These control weaknesses, if uncorrected, could lead to significant losses
to the government and taxpayers because they increase the risk of loss,
theft, or mishandling of taxpayer receipts and data. Table 1 demonstrates
the pervasiveness of the internal control issues found during calendar year
2002. These issues are discussed briefly below and are discussed in more
detail in appendix I.



Table 1: Internal Control Issues Found at Lockbox Locations in Calendar Year 2002

Lockbox bank location                                      1       2   3   4     5     6    7    8    9
     Physical security issues                              X       X   X   X     X     X    X    X    X
     Processing control issues                             X       X   X   X     X     X    X    X
     Courier security issues                                       X   X         X
     Employee screening issues                             X       X   X                    X    X
Source: Findings based on reviews at the nine lockbox locations.




21
     GAO-02-35.




Page 26                                                                        GAO-03-299 IRS Lockbox Banks
Physical Security            Given the large volume and assembly-line nature of tax receipt processing,
Weaknesses Could Allow       lockbox operations generally occur in areas with open floor plans, where
                             taxpayer data and receipts are easily accessible to individuals on the
Unauthorized Access to
                             processing floor. Thus, the vulnerability of sensitive tax data and receipts
Taxpayer Data and Receipts   to theft or misuse is heightened. This vulnerability underscores the need
                             for effective controls to deter and detect unauthorized access to taxpayer
                             data and receipts. However, during our visit to lockbox locations, we
                             observed numerous physical security breaches. Of the nine lockbox
                             locations we visited, we found the following:

                             • At four locations, perimeter doors leading into processing areas were
                               unlocked or door alarms did not function effectively.

                             • At two locations, guards were not responsive to alarms.

                             • At one location, employee identification was not adequately verified.

                             • At two locations, employment status of temporary employees was not
                               adequately verified.

                             • At two locations, visitor access to and activity in processing areas were
                               not adequately controlled.

                             • At six locations, guards did not closely monitor items brought into or
                               out of the processing areas or prevent unauthorized items, such as
                               personal belongings, in the processing area.

                             • At seven locations, camera surveillance needed to be improved.

                             These security weaknesses increase the risk of theft and mishandling of
                             taxpayer data and receipts and reduce the possibility of the timely
                             detection of such incidents.



Processing Controls Need     In addition to physical security controls, lockbox banks are required to
Improvement to Better        implement processing controls to maintain accountability for and security
                             over transactions as they are processed in the normal course of operations.
Account for and Protect
                             During our visits, we found deficiencies in processing controls designed to
Taxpayer Data and Receipts   account for or protect tax data and receipts at most of the lockbox
                             locations. Specifically, of the nine locations we visited, we found the
                             following:



                             Page 27                                           GAO-03-299 IRS Lockbox Banks
                             • At four locations, candling procedures were not adequate to minimize
                               the risk of accidental destruction of tax data and receipts.

                             • At four locations, lockbox bank management did not reconcile candling
                               logs to properly account for all items found during candling.

                             • At six locations, lockbox bank managers did not perform required
                               reviews of the candling process or did not adequately document results
                               of their reviews.

                             • At three locations, controls were not in place to adequately safeguard
                               and account for cash receipts.

                             • At seven locations, returned refund checks were not adequately
                               protected against theft.

                             • At one location, timely payments were incorrectly processed as
                               delinquent.

                             Inadequate accounting and safeguarding of tax payments and related
                             vouchers or returns could lead to taxpayer burden, such as penalties and
                             interest for failure to pay tax liabilities, if these items are accidentally
                             destroyed, stolen, or incorrectly processed. Additionally, inadequate
                             processing controls could result in errors not being detected promptly or
                             additional work for IRS employees who must correct taxpayer accounts as
                             a result of errors.



Courier Security             Lockbox banks employ courier services to deliver (1) mail from post
Weaknesses Expose Tax        offices to lockbox processing sites, (2) processed checks to depository
                             banks, and (3) tax data and unprocessable receipts to IRS Submission
Data and Receipts to Theft
                             Processing Centers. During peak processing periods, couriers are entrusted
and Loss                     with transporting thousands of pieces of mail each day that contain tax
                             data, cash, checks, and deposits worth millions of dollars. Given the
                             susceptibility of these items to theft and loss, it is important that they be
                             carefully safeguarded while in transit to and from lockbox locations.
                             However, our review and reviews conducted by TIGTA and IRS found
                             several problems with courier security during calendar year 2002. These
                             problems relate to failure to comply with courier security requirements as
                             well as deficiencies in the current requirements. Specifically, at the nine
                             locations, we and other reviewers found the following:




                             Page 28                                           GAO-03-299 IRS Lockbox Banks
                          • At one location, couriers with criminal records were given access to tax
                            data before bank management received results of their FBI fingerprint
                            checks.

                          • At two locations, couriers were not properly identified.

                          • At two locations, courier vehicles containing tax data and receipts were
                            not locked.

                          • At all locations, background screening requirements for lockbox
                            couriers were less stringent than screening requirements for IRS
                            couriers.

                          • At all locations, courier requirements did not prohibit unauthorized
                            individuals in courier vehicles or require lockbox staff to inspect courier
                            vehicles for unauthorized passengers.

                          Until these courier security weaknesses are addressed, tax data and
                          receipts in transit to and from lockbox locations are exposed to higher
                          risks of theft and loss.



Background Screening of   Because lockbox employees are entrusted with handling sensitive taxpayer
Lockbox Employees Needs   information and billions of dollars in receipts annually, ensuring worker
                          integrity through a carefully managed recruiting and hiring process is an
Further Improvement
                          area that demands special attention from IRS, FMS, and lockbox
                          management. However, during our review and those performed by TIGTA
                          and IRS, we found that lockbox banks did not always comply with the FBI
                          screening requirements and that further refinements to background
                          investigation requirements for lockbox employees are needed. Specifically,
                          for the nine locations, we and other reviewers found the following:

                          • At five locations, employees were given access to taxpayer data and
                            receipts before bank management received results of their FBI
                            fingerprint checks.

                          • At all locations, requirements for background investigations of lockbox
                            permanent employees were unclear and resulted in variations in the
                            scope and documentation of background investigations conducted on
                            them.




                          Page 29                                           GAO-03-299 IRS Lockbox Banks
                         • At all locations, FBI fingerprint checks for lockbox employees who are
                           not U.S. citizens with lawful permanent residence status may not be
                           adequate to disclose criminal histories for individuals who have only
                           recently established residence in the United States.

                         These weaknesses increase the risk of theft of tax data and receipts by
                         individuals who may be unsuitable to work at IRS lockbox sites.



A Comprehensive          IRS and FMS have not performed a comprehensive study evaluating the full
                         range of costs and benefits of IRS processing tax receipts versus the
Study Evaluating Costs   lockbox banks processing the receipts for all types of tax receipts
for IRS Processing       processed by the banks. Over the years, several studies have been
                         performed evaluating the degree of interest float savings resulting from the
Versus Using Lockbox     use of lockbox banks. IRS and FMS jointly performed the most recent
Banks for All Types of   study in 1999 in response to a Treasury OIG recommendation. In the 1999
Tax Receipts Has Not     joint study, IRS and FMS considered the costs and benefits to the federal
                         government of using lockbox banks rather than IRS to process Form 1040
Been Performed           tax receipts more quickly. Having adopted this perspective in accordance
                         with Treasury regulations, IRS and FMS did not consider some costs, such
                         as opportunity costs, or the results from alternative uses of the money
                         spent to achieve speedier deposits. Foregoing speedier deposit of tax
                         receipts and using the funds elsewhere could, according to recent IRS data,
                         result in financial benefits to the government that could be greater,
                         depending on the study assumptions used. In effect, IRS and FMS did not
                         consider the implications of such alternatives available to IRS. In addition,
                         the study did not clearly define the type of analysis done. Differing types of
                         analysis would require consideration of differing costs and benefits and
                         could result in different decisions than were made on the basis of the 1999
                         study.

                         Due to changes in IRS, the lockbox bank network, and other factors, the
                         1999 study will not be useful to support IRS and FMS officials’ future
                         decision about whether to continue the lockbox arrangement when the
                         current agreements expire in 2007. IRS and FMS officials initially stated
                         that they had not planned to conduct a new study before the lockbox
                         agreements expire in 2007, but that a new study might be appropriate given
                         many changes and the passage of time since 1999.




                         Page 30                                            GAO-03-299 IRS Lockbox Banks
The 1999 Study Results Did   In keeping with instructions in the Treasury Financial Manual (TFM), the
Not Consider All Costs and   purpose of the IRS/FMS study was to determine whether using lockbox
                             banks or IRS to process most individual income tax receipts would
Benefits
                             minimize the total cost to the federal government. The TFM defines total
                             cost to include agency costs, the cost of purchased services, and any loss of
                             interest earnings to the government due to delays in depositing receipts.22

                             The study described three scenarios (described in app. II) in comparing
                             estimated lockbox bank and IRS processing costs for fiscal years 2001
                             through 2007 based on different assumptions. The study used scenario I,
                             the most conservative scenario, to support the decision to continue using
                             lockbox banks. This scenario showed that IRS could spend about $56
                             million to internally process tax receipts, or could join with FMS to spend a
                             total of $144.9 million to use lockbox banks to process tax receipts more
                             quickly.23 The study concluded that the lockbox processing would be more
                             costly but would save the government $100.5 million in interest that
                             otherwise would be lost due to slower deposits if IRS processed the
                             receipts. These interest savings more than offset the additional processing
                             costs, producing net savings over 7 years of $11.6 million to the federal
                             government from using lockbox banks rather than IRS to process tax
                             receipts. Scenario I is used throughout this report in the cost comparisons
                             shown, unless otherwise noted. Table 2 shows these cost comparisons.




                             22
                                  Volume 1, Part 6, Section 8025.30 Collection Mechanisms.
                             23
                              IRS would pay for $60.3 million of this cost out of its budget; FMS would use Treasury
                             Time Balances (TTB) to compensate the banks for the remaining $84.5 million. TTBs are
                             deposited in lockbox banks and the interest that banks earn on those deposits is their
                             compensation. We did not analyze these funding sources. The estimated federal funds rate
                             used for this study was 5 percent.




                             Page 31                                                         GAO-03-299 IRS Lockbox Banks
Table 2: Comparison of the Cost to the Federal Government of Alternative Receipt
Processing Approaches, Fiscal Years 2001-2007

Dollars in millions
                                                Costs for                      Lockbox costs
                                                  lockbox Costs for IRS            minus IRS
                                               alternative  alternative               costsa
IRS expenditures                                     $60.3            $56.0             $4.4
FMS compensation to banks                             84.5                 0            84.5
Interest lost by government due to
slower deposits                                         0.0           100.5           (100.5)
Costs (savings) to federal
government                                          $144.9           $156.5           ($11.6)
Source: GAO analysis of 1999 IRS/FMS study.
a
Differences between IRS and lockbox processing costs may be affected by rounding.


However, IRS and FMS did not consider various costs in these estimates.
Most notably, they did not consider opportunity costs related to alternate
uses of IRS funds to accelerate tax deposits. Each year, the Congress
approves a budget for an agency and provides discretion, within certain
constraints, on agency spending. Given resource constraints, IRS must
effectively choose how to spend its fixed budget. IRS and FMS decided that
it would be worth spending $4.4 million more out of IRS’s budget to use
lockbox banks to process tax receipts compared to IRS’s slower process
because net savings to the government would reach $11.6 million over the 7
years.

IRS and FMS did not consider whether greater financial benefits could
accrue to the government if IRS processed receipts and used the estimated
extra $4.4 million from IRS’s budget to generate higher revenues through
other programs or activities.24 Recent estimates by IRS’s Research Division
have pointed to other activities—such as tax enforcement—in which
spending the extra $4.4 million would have generated from at least $44
million to well over $100 million. For example, in some enforcement



24
 The $84.5 million of funding provided by FMS through TTBs could not be reallocated to
other IRS activities because Treasury permits TTBs to be used solely to pay for depository
services that expedite deposits to the Treasury.




Page 32                                                        GAO-03-299 IRS Lockbox Banks
programs for just individual taxpayers, the ratio of estimated marginal tax
revenue gained to additional spending was

• 13:1 to pursue known tax debts through phone calls,

• 32:1 to identify unreported income by computer matching tax returns
  and information returns, such as Forms W-2 and 1099, and

• 11:1 to audit tax returns through correspondence.

Our reference to these alternate uses and ratios is for illustrative purposes.
We did not analyze the basis for IRS’s estimates that produced these ratios.
However, we have found over the years that IRS has had difficulty readily
accumulating the costs of various activities because IRS lacks a cost
accounting system.25 Despite these caveats, if these estimated ratios and
scenario I estimates are approximately accurate, IRS and FMS might have
made a different decision by considering opportunity costs.26

Although opportunity costs may be the most significant costs not
considered, the study also excluded certain direct IRS and FMS costs, as
discussed below.

• IRS and FMS costs to oversee lockbox bank processing: As discussed
  earlier in this report, these agencies use staff to oversee and review
  operations of lockbox banks.

• Costs to reduce the risk in processing tax receipts: This risk became
  evident during the 2001 filing season, with the incident at the Pittsburgh
  lockbox affecting about 78,000 taxpayer receipts. As of September 30,
  2002, the government had lost an estimated $13.5 million in interest
  from missing tax receipts, and IRS has spent about $4.3 million to
  resolve problems with taxpayer accounts. In October 2002, Mellon Bank
  agreed to pay the government $18.1 million to cover administrative costs

25
 U.S. General Accounting Office, Financial Audit: IRS’s Fiscal Years 2002 and 2001
Financial Statements, GAO-03-243 (Washington, D.C.: Nov. 15, 2002).
26
 If IRS and FMS chose the internal processing alternative, the federal government would
have lost the estimated $100.5 million in interest earnings but would have saved the $84.5
million paid through the TTBs and an additional $4.4 million from IRS’s budget. This choice
would have been better from a federal budget standpoint as long as IRS generated at least
$16 million (the difference between $100.5 million and $84.5 million) by investing the $4.4
million elsewhere.




Page 33                                                    GAO-03-299 IRS Lockbox Banks
                                   and expenses associated with the incident; however, these costs
                                   continue to grow as IRS is still resolving some issues.

                              • Costs to process different types of receipts: The study only considered
                                Form 1040 tax receipts in response to a Treasury OIG report that
                                questioned having lockbox banks rather than IRS process such tax
                                receipts. Lockbox banks are also paid to process other types of tax
                                receipts related to more than 10 other tax forms, such as Forms 1041
                                and 941.27

                              It is not known if these costs would be significant enough to change the
                              study’s conclusions. It is also not known to what extent such costs would
                              be offset by additional direct costs to IRS associated with returning the
                              receipt processing function to IRS.



Alternate Study Approaches    IRS and FMS characterized the study at various times as a cost-benefit
Could Affect the Costs and    analysis and as a cost-effectiveness analysis. These types of studies would
                              include different costs and benefits from those included in the 1999 study.
Benefits Considered and the
                              If IRS and FMS had done a cost-benefit or cost-effectiveness study, the
Study Results                 resulting conclusions may have differed. Being clear about the type of
                              analyses being done and the limitations and uses of the related results
                              helps decision makers to interpret and use those results.

                              The 1999 study was neither a cost-benefit nor a cost-effectiveness analysis
                              in economic terms. Cost-benefit and cost-effectiveness analyses are two
                              tools that are commonly used to determine whether government
                              investments or programs can be justified on economic principles. These
                              tools also help to identify the best alternative from a range of competing
                              investment alternatives. Economists commonly agree that, when either of
                              these two analyses is used to evaluate federal programs that affect




                              27
                                The study did not consider whether lockbox banks instead of IRS should process certain
                              types of forms, or whether lockbox banks should process all or none of the forms.




                              Page 34                                                   GAO-03-299 IRS Lockbox Banks
private citizens or other entities, the analysis should include costs and
benefits to individuals and entities outside of the federal government.28

The IRS/FMS study was not a cost-benefit analysis because it did not
consider costs or benefits to individuals or entities outside the federal
government, such as taxpayers.29 By considering costs and benefits beyond
the government, the study should address whether the benefits gained by
the federal government (on behalf of society as a whole) outweigh the
costs imposed on certain members of society, such as taxpayers. The
lockbox program affects taxpayers and/or their banks by reducing their
interest float benefits through quicker depositing of their tax receipts. The
additional interest gained by the federal government through accelerated
tax deposits comes with a similar loss of interest to taxpayers who mail in
payments.30 The acceleration of deposits largely shifts who benefits. This
shifting of interest benefits may have some value to society in terms of a
more equitable sharing of the costs of government; however, it is difficult to
put a dollar value on improved equity and that value is not necessarily equal
to the dollar amount of interest that is transferred from taxpayers and/or
banks to the government. Since these interest gains by the federal
government made the use of lockbox banks beneficial, a different valuation
of these gains could have resulted in a different decision about whether to
contract with the banks.




28
 See OMB, Circular A-94 Revised, Guidelines and Discount Rates for Benefit-Cost
Analysis of Federal Programs (Washington, D.C.: Oct. 29, 1992), section 6; and OMB,
Circular A-130, Management of Federal Information Resources (Washington, D.C.: Nov.
30, 2000), section 7.
29
 A cost-benefit analysis estimates the discounted values of the expected benefits and costs
of an investment or program and then subtracts the costs from the benefits to determine the
net present value (NPV). The costs and benefits associated with an investment or program
are typically spread over many years. Discounting (the computation of present values) is
necessary to reflect the fact that a dollar of benefit or cost in a future year is worth less than
a dollar of benefit or cost in the current year. Programs with larger positive NPVs are
generally preferred over those with smaller or negative NPVs.
30
     Some or all of the interest loss actually may be incurred by the taxpayers’ banks.




Page 35                                                         GAO-03-299 IRS Lockbox Banks
                              The study also is not a cost-effectiveness analysis because it did not
                              compare program alternatives that had the same objectives.31 Instead, the
                              alternatives of using lockbox banks or IRS staff to deposit tax receipts
                              assumed that lockbox banks would achieve a faster speed of depositing
                              receipts than IRS. In order to determine the cost-effectiveness of the
                              lockbox program, the analysts would have had to compare the costs of that
                              program to the costs of one or more IRS alternatives that would achieve the
                              same speed of depositing. It is not clear that a cost-effectiveness study
                              comparing like processing speeds would have yielded the same result as
                              the 1999 study.

                              The specific type of study that should be done to support a decision about
                              whether to accelerate the deposit of tax receipts through lockbox banks is
                              a matter of judgment. However, because the type of analysis that flows
                              from the decision about the type of study to do can affect the study results,
                              it is important that study leaders clearly define the type of analysis to be
                              undertaken and why.



1999 Study Will Not Support   Since 1999, many changes have occurred at IRS and the lockbox bank
IRS’s and FMS’s Future        network that could affect processing and future cost comparisons. For
                              example, IRS began moving to a new organizational structure in October
Decision about Continuing
                              2000, which has changed where and how IRS processes certain types of tax
the Lockbox Bank              returns and receipts. In addition, the network of lockbox banks (in terms of
Arrangement beyond 2007       how many and which banks are involved) has changed. Starting in 2002,
                              processing also included new security requirements, such as having FBI
                              fingerprint checks done for each employee or contractor, to reduce the
                              risks of thefts. Finally, changes in the 1999 study assumptions would be
                              likely by 2007. Such assumptions involve

                              • the number of days of interest float;

                              • the number of tax receipts and number of Forms 1040 filed
                                electronically;


                              31
                               A cost-effectiveness analysis is used to determine the least-cost approach for achieving a
                              specified objective. This analysis does not provide a justification for pursuing the objective
                              but simply identifies the best approach after deciding on the objective. A fundamental
                              characteristic of a cost-effectiveness analysis is that the specified objective does not vary
                              across alternatives being compared.




                              Page 36                                                       GAO-03-299 IRS Lockbox Banks
              • IRS labor, computer, and space costs;

              • lockbox bank charges; and

              • interest rates.

              For example, IRS and FMS assumed that lockbox banks would process tax
              receipts 1.384 days faster than IRS under scenario I based on a 1998 study
              by a contractor. 32 However, IRS and FMS cannot be certain that any
              advantage that lockbox banks might have had in 1999 still exists due to the
              changes to IRS’s structure and the lockbox bank network.

              IRS and FMS officials stated that they had not planned to conduct a new
              study before the lockbox agreements expire in 2007. However, they have
              indicated that such a study may be warranted given many changes and the
              passage of time since 1999.



Conclusions   Approximately $268 billion in tax receipts IRS collected in fiscal year 2002
              were processed through lockbox banks. Given the significance of tax
              receipts processed by lockbox banks, effective oversight and sound
              internal controls at lockbox sites are critical to protect taxpayer data and
              receipts. The loss and destruction of tax receipts at the Pittsburgh lockbox
              site highlighted the need for increased scrutiny and oversight of these
              banks.

              Our review of the 1993 and 2002 lockbox contractual agreements revealed
              nothing inherent in their provisions that would necessarily encourage
              lockbox employees to mishandle taxpayer receipts. It is possible that in an
              effort to avoid penalties allowed under the agreements, such as financial
              penalties or contract termination, lockbox bank employees might make
              poor decisions about handling taxpayer receipts; however, these are
              important provisions designed to help the government address inadequate
              contractor performance.



              32
                The contractor concluded that lockbox banks processed tax receipts on average 2 days
              faster than IRS. However, IRS and FMS revised the 2-day lockbox advantage in each of the
              three scenarios in the 1999 study on the basis of assumptions, such as a promise by the
              lockbox banks to compress processing by 1 day. See appendix II for further explanation of
              the three scenarios that IRS and FMS used in the 1999 study.




              Page 37                                                    GAO-03-299 IRS Lockbox Banks
                      While FMS and IRS significantly improved their oversight of lockbox banks
                      during 2002, oversight and internal control deficiencies impeded the
                      effectiveness of this oversight in minimizing the risk to the federal
                      government and taxpayers. These deficiencies need to be addressed to
                      provide increased assurance that taxpayer data and receipts are properly
                      safeguarded. IRS’s and FMS’s oversight of lockbox banks has not been fully
                      effective primarily because their oversight roles and responsibilities have
                      not been sufficiently defined and documented. Additionally, numerous
                      internal control weaknesses need to be corrected and certain provisions of
                      the lockbox processing guidelines need to be revised. Until these oversight
                      and internal control deficiencies are addressed, the security of taxpayer
                      data and receipts may be compromised.

                      The most recent study done by IRS and FMS in 1999 followed Treasury
                      regulations in considering only the costs and benefits to the federal
                      government of achieving speedier tax deposits by using lockbox banks to
                      process individual tax receipts (Form 1040). In doing so, the study did not
                      consider other types of receipts processed by the lockbox banks or some
                      relevant direct costs in comparing lockbox and IRS processing costs nor
                      did it consider opportunity costs. Accounting for opportunity costs would
                      be consistent with agencies’ responsibility to use budget funds
                      economically and efficiently and should be considered regardless of the
                      type of analysis that IRS and FMS undertake. However, the type of analysis
                      affects other types of cost and benefit data that should be considered and
                      therefore may affect the study results. IRS and FMS were not clear on the
                      type of analysis done in 1999. Because certain data and assumptions from
                      the 1999 study are now obsolete, IRS and FMS will need to conduct another
                      study to determine whether to continue using lockbox banks when the
                      agreement expires in 2007.



Recommendations for   To decrease the likelihood that further incidents involving the loss and
                      destruction of taxpayer receipts and data will occur, we recommend that
Executive Action      the Commissioner of FMS and Acting Commissioner of IRS thoroughly
                      review the results of TIGTA’s investigation of the 2001 incident at the
                      Pittsburgh lockbox site when it is completed and, if the results warrant,
                      implement additional controls and modify the lockbox contractual
                      agreements as appropriate.




                      Page 38                                          GAO-03-299 IRS Lockbox Banks
To improve the effectiveness of government oversight of lockbox banks,
we recommend that the Commissioner of FMS and the Acting
Commissioner of IRS

• document IRS’s and FMS’s oversight roles and responsibilities in agency
  policy and procedure manuals and determine the appropriate level of
  IRS and FMS oversight of lockbox sites throughout the year, particularly
  during peak processing periods;

• establish and document guidelines and procedures in IRS and FMS
  policy and procedure manuals for implementing the new penalty
  provision for lockbox banks to reimburse the government for direct
  costs incurred in correcting errors made by lockbox banks;

• finalize and document the recently developed waiver process in IRS and
  FMS policy and procedure manuals and ensure that decisions on
  requests for waivers are formally and promptly communicated to
  lockbox management; and

• establish and document a process in IRS and FMS policy and procedure
  manuals to ensure that lockbox bank management formally responds to
  IRS and FMS oversight findings and recommendations promptly and
  that corrective actions taken by lockbox bank management are
  appropriate.

To improve the effectiveness of government oversight of lockbox banks,
we also recommend that the Acting Commissioner of IRS

• establish and document a process in IRS policy and procedure manuals
  to ensure that IRS officials with the appropriate levels of expertise
  continue to participate in announced and unannounced security reviews
  of lockbox banks;

• ensure that the results of on-site compliance reviews are completed and
  promptly submitted to IRS’s National Office;

• revise the guidance used for compliance reviews so it requires reviewers
  to (1) determine whether lockbox contractors, such as couriers, have
  completed and obtained favorable results on IRS fingerprint checks and
  (2) obtain and review all relevant logs for cash payments and candled
  items to ensure that all payments are accounted for; and




Page 39                                         GAO-03-299 IRS Lockbox Banks
• assign individuals, other than the lockbox coordinators, responsibility
  for completing on-site performance reviews.

To improve internal controls at lockbox banks, we recommend that the
Commissioner of FMS and the Acting Commissioner of IRS

• require that internal control deficiencies are corrected by lockbox bank
  management and that IRS and FMS take steps through ongoing
  monitoring to ensure that the following LPG requirements are routinely
  adhered to:

   • perimeter doors are locked and alarms on perimeter doors are
     functioning,

   • guards are responsive to alarms,

   • employees’ identity and employment status are verified prior to
     granting access to the processing floor,

   • visitor access to and activity in the processing area are adequately
     controlled,

   • employee access and items brought into and out of processing areas
     are closely monitored by guards,

   • surveillance cameras and monitors are installed in ways that allow
     for effective, real-time monitoring of lockbox operations,

   • envelopes are properly candled,

   • lockbox bank management perform and adequately document
     candling reviews,

   • returned refund checks are restrictively endorsed immediately upon
     extraction,

   • lockbox couriers are properly identified prior to granting them
     access to taxpayer data and receipts, and

   • employees have received favorable results on fingerprint checks
     before they are granted access to taxpayer data and receipts.




Page 40                                          GAO-03-299 IRS Lockbox Banks
• revise the lockbox processing guidelines to require that

   • before lockbox bank couriers receive access to taxpayer data and
     receipts they undergo and receive favorable results on background
     investigations that are deemed appropriate by IRS and are consistent
     across lockbox banks,

   • before permanent lockbox bank employees receive access to
     taxpayer data and receipts they undergo and receive favorable
     results on background investigations that are deemed appropriate by
     IRS and are consistent across lockbox banks,

   • lockbox bank guards inspect courier vehicles for unauthorized
     passengers and unlocked doors,

   • candling procedures for the various types of extraction methods be
     clarified,

   • during candling, lockbox bank employees record which machines
     and which extraction clerks missed items,

   • lockbox bank management reconcile items found during candling to
     the candling records,

   • lockbox bank management reconcile cash payments to internal cash
     logs and the cash logs they provide to IRS, and

   • lockbox employees immediately seek processing guidance from the
     lockbox coordinator if envelopes with timely postmark dates are
     received after the postmark review period has ended.

Because IRS and FMS must decide before 2007 whether to continue using
lockbox banks to process tax receipts or to return that function to IRS, we
recommend to the Secretary of the Treasury that a study be done in time
(1) for its findings to be considered in the decision-making process and (2)
to make any improvements to lockbox processing that the study indicates
are necessary or to return the processing to IRS. Regardless of the type of
analysis chosen, we recommend that the Secretary of the Treasury

• clearly define the type of analysis being done and why, and follow
  through to identify and analyze costs and benefits relevant to the type of
  analysis,



Page 41                                           GAO-03-299 IRS Lockbox Banks
                         • consider the opportunity costs associated with the proposed
                           investment in using lockbox banks to accelerate the deposit of tax
                           receipts, and

                         • include the direct costs associated with oversight, risk reduction, and
                           non-Form 1040 tax receipts.



Agency Comments and   Treasury’s response to a draft of this report was jointly prepared by IRS and
                      FMS. In responding to the report, IRS and FMS agreed with our findings
Our Evaluation        and recommendations and stated that they have initiated or plan to initiate
                      actions to implement our recommendations. IRS and FMS agreed to
                      continually monitor lockbox banks’ adherence to internal controls and to
                      modify the LPGs to improve consistency standards and clarify instructions.
                      IRS and FMS also agreed to complete an analysis of lockbox processing
                      prior to the expiration of the current lockbox agreements to determine how
                      best to satisfy IRS’s remittance processing needs. In their response, IRS and
                      FMS indicated many actions they have taken since October 2001 to
                      improve lockbox operations. We identified many of these improvements
                      during our review and documented them in our report, such as the
                      establishment of the Bank Review Office within FMS and the development
                      of memoranda of understanding concerning oversight roles and
                      responsibilities. These actions and agreements will need to be promptly
                      completed and thoroughly documented to satisfactorily address many of
                      the issues raised in this report. The complete text of Treasury’s response is
                      reprinted in appendix III.


                      As agreed with your office, unless you announce its contents earlier, we
                      plan no further distribution of this report until 30 days after its issuance
                      date. At that time, we will send copies to the Chairmen and Ranking
                      Minority Members of the Senate Committee on Appropriations; Senate
                      Committee on Governmental Affairs; Senate Committee on the Budget;
                      Subcommittee on Treasury, General Government, and Civil Service, Senate
                      Committee on Appropriations; Subcommittee on Oversight of Government
                      Management, Restructuring, and the District of Columbia, Senate
                      Committee on Governmental Affairs; House Committee on Appropriations;
                      House Committee on Ways and Means; House Committee on Government
                      Reform; House Committee on the Budget; Subcommittee on Government
                      Efficiency, Financial Management, and Intergovernmental Relations, House
                      Committee on Government Reform; and Subcommittee on Oversight,



                      Page 42                                           GAO-03-299 IRS Lockbox Banks
House Committee on Ways and Means. We will also provide copies to the
Chairman and Vice-Chairman of the Joint Committee on Taxation, the
Secretary of the Treasury, the Commissioner of FMS, the Acting
Commissioner of IRS, the Director of the Office of Management and
Budget, the Chairman of the IRS Oversight Board, and other interested
parties. Copies will be made available to others upon request. In addition,
the report will be made available to others at no charge on GAO’s Web site
at http://www.gao.gov.

If you have any questions about this report, please contact Steve Sebastian
at (202) 512-3406 (SebastianS@gao.gov) or Mike Brostek at (202) 512-9110
(BrostekM@gao.gov). Additional key contributors to this assignment are
listed in appendix IV.




Steven J. Sebastian
Director
Financial Management
 and Assurance




Michael Brostek
Director
Tax Administration
 and Justice




Page 43                                          GAO-03-299 IRS Lockbox Banks
Appendix I

Internal Control Weaknesses                                                                                  Ap
                                                                                                              A
                                                                                                              pp
                                                                                                               ep
                                                                                                                ned
                                                                                                                  nx
                                                                                                                   ide
                                                                                                                     x
                                                                                                                     Iis




                                During calendar year 2002, we visited all nine lockbox locations to review
                                their internal controls designed to protect taxpayer data and receipts.
                                TIGTA auditors and IRS reviewers also performed reviews of lockbox
                                controls in 2002. Below are the specific internal control issues with
                                (1) physical security, (2) processing controls, (3) courier security, and
                                (4) employee screening, that we and other reviewers found at lockbox
                                sites.



Physical Security               The Lockbox Processing Guidelines (LPG) establish physical security and
Weaknesses Could Allow          other processing requirements. Lockbox banks are required by their
                                agreements with FMS to abide by these guidelines. However, during our
Unauthorized Access to          visit to lockbox locations, we observed numerous physical security
Taxpayer Data and Receipts      breaches in violation of the LPGs. We also identified areas where the LPGs
                                could be strengthened. These matters are discussed in the following
                                sections.

Perimeter Doors Were Unlocked   To detect attempted breaches into secured space, lockbox guidelines
and Alarms Did Not Function     require all perimeter doors leading into IRS lockbox space to be equipped
                                with alarms. The guidelines also require guards to ensure that such doors
                                are locked. However, at four lockbox locations, we noted problems with
                                perimeter door security. At one location, we found a perimeter door
                                unlocked. At another location, a perimeter door was not equipped with an
                                audible alarm during operating hours. Bank management did not think an
                                audible alarm was necessary because an additional interior door that was
                                locked during the day controlled access to the processing area. However,
                                we observed that this interior door was propped open during our visit. At
                                this location, we also found that the alarm for another door was barely
                                audible over the noise from the production floor and immediately ceased
                                when the door was closed, limiting the opportunity for security personnel
                                to determine which door opened and to investigate any possible
                                unauthorized entrance or exit. At a third location, the alarms for one set of
                                doors were not turned on during operating hours, and the alarm for another
                                perimeter door failed to activate because, according to a bank official, the
                                alarm had not been properly set. At a fourth location, the door alarms were
                                not audible at the guard post because the guards had turned down the
                                volume. These security weaknesses could result in unauthorized entry to
                                and exit from the lockbox processing areas, increasing the risk of theft of
                                tax data and receipts.




                                Page 44                                           GAO-03-299 IRS Lockbox Banks
                                  Appendix I
                                  Internal Control Weaknesses




Guards Were Not Responsive to     Door alarms serve to alert lockbox staff to a possible breach of security. To
Alarms                            be an effective physical security control, alarms require quick response
                                  time by a security force. However, at two of the lockbox locations where
                                  we found problems with perimeter door security, we also noted that
                                  security guards were not responsive to alarms. For example, at one
                                  location, we tested the alarm twice. On the first test, no guard responded to
                                  the alarm. On the second test, it took 1 minute after the door was opened
                                  before we saw a guard approaching the door. Bank managers believed that
                                  their guards should have responded faster. At another location, the
                                  perimeter door alarm sounded twice, and both times the guards did not
                                  respond. According to the bank manager, the guards’ post orders did not
                                  instruct guards to respond to alarms. He also added that it was difficult for
                                  the guards to hear the alarms from the guard station.

                                  The presence of security guards serves to detect unusual activities and to
                                  deter crime. An ineffective security force may not only limit the overall
                                  effectiveness of a security system but also may inadvertently encourage
                                  security breaches from individuals who decide to take advantage of this
                                  weakness.

Employee Identification Was Not   Lockbox locations are set up with a main entrance where guards can
Adequately Verified               observe and control the traffic into and out of the processing area. The
                                  LPGs require that temporary employees provide photo identification to the
                                  guards in exchange for a badge allowing access to the processing floor.
                                  This ensures the identity of temporary employees is validated prior to
                                  entering the processing area.

                                  We found that at one location, guards did not routinely verify temporary
                                  employee identification when they entered the processing area. Bank
                                  management believed that manual, daily verification of temporary
                                  employee identification was not necessary because the location’s
                                  automated entry system (AES) provided sufficient controls to limit access
                                  to authorized individuals. The AES allowed entry into the building and
                                  processing floor to individuals with AES cards, which control the door and
                                  turnstile locks. AES cards are issued to temporary employees after the
                                  guards have verified the employees’ identities with valid photo
                                  identification cards on their first day of work. Once these employees are
                                  issued AES cards, guards no longer verify the employees’ identification
                                  before they enter the building and processing floor. Temporary employees
                                  wear handwritten name tags with no photo identification to easily verify
                                  their identity. As a result, if an unauthorized individual obtains an AES
                                  card, the lack of routine verification of employee identification increases



                                  Page 45                                           GAO-03-299 IRS Lockbox Banks
                                    Appendix I
                                    Internal Control Weaknesses




                                    the likelihood that an individual could gain unauthorized access to the
                                    building and the processing floor, thereby increasing the risk of theft of tax
                                    data and receipts.

Employment Status of                Effectively limiting access at lockbox locations to authorized individuals
Temporary Employees Was Not         requires controls that not only verify the identity of employees, but also
Adequately Verified                 determine whether individuals who present themselves as employees are
                                    currently authorized to have access to the site. We found controls over
                                    verification of employment status to be ineffective at two locations.

                                    At one location, the controls implemented to validate an individual’s
                                    current employment were ineffective.33 The two-step manual process to
                                    identify temporary employees and check their current employment status
                                    before issuing access badges could have allowed unauthorized individuals
                                    to enter the processing area. The first step required temporary employees
                                    to obtain name tags from one station. Staff at this station checked the
                                    employees’ identification cards against a roster of current employees and
                                    issued them handwritten name tags. The second step required temporary
                                    employees to obtain access badges from the guard station. The guards
                                    issued access badges to anyone with a valid photo identification and
                                    handwritten name tag, making an assumption that those with name tags
                                    were current employees. As a result, an unauthorized individual could have
                                    circumvented these controls and gained access to the processing floor by
                                    making a name tag and presenting it to the guards. At another location,
                                    guards did not compare temporary employees’ identification cards to the
                                    temporary agency’s list of current employees until after the employees
                                    were given access to the processing area. This increases the risk that
                                    unauthorized individuals could gain access to taxpayer data and receipts
                                    and not be promptly detected.

Visitor Access to and Activity in   Anyone entering the lockbox processing area must wear an identification
Processing Area Were Not            badge. In addition, individuals who have not had an FBI fingerprint check,
Adequately Controlled               but require access to the processing floor, must be escorted by a guard.
                                    However, at one lockbox location, we observed a copy machine repairman
                                    with no identification badge who was unescorted in the processing area.
                                    The guards indicated they were unaware whether the contractor had
                                    received an FBI fingerprint and therefore one of the guards had escorted


                                    33
                                     Unlike the previous example, this location did not use an automated entry system to
                                    control access to the processing area. Instead, temporary employees were manually issued
                                    access badges and name tags each day.




                                    Page 46                                                   GAO-03-299 IRS Lockbox Banks
                                Appendix I
                                Internal Control Weaknesses




                                the repairman into the processing area. However, during our observation,
                                the guard was across the room, too far away to effectively observe what the
                                repairman was doing. We also observed that none of the employees near
                                the repairman challenged his presence. Bank managers later showed us
                                proof that the repairman had successfully completed an FBI fingerprint
                                check and explained that the guards should have given him a visitor badge,
                                but did not need to escort him. Although in this case the contractor turned
                                out to have an adequate security clearance, our observation indicated a
                                need for guards to be better trained on procedures for granting access to
                                contractors and for guards and employees to be more alert to activities on
                                the processing floor.

                                We also found malfunctioning AESs designed to control entrance into and
                                exit from processing areas. Two lockbox locations use an AES to control
                                access to the processing area. According to bank management for these
                                two locations, the AES must register an exit for a specific badge before it
                                can be used again to enter the processing area. In addition, the AES should
                                not allow an individual to exit without a registered entry. In other words, in
                                order for anyone to use an access badge to exit the processing area through
                                the controlled access points, the system must first have a record of that
                                badge as having been used to enter, otherwise exit from the area would be
                                denied. However, due to a programming error, we found that the AES did
                                not function as intended. Specifically, we found that a single visitor badge
                                could be used repeatedly by different individuals, one after another, to gain
                                access to the processing area, because the AES did not require a registered
                                exit between registered entries. Moreover, we found that the badges
                                allowed individuals to exit the processing area even though the AES did not
                                initially record their entrance. This AES deficiency compromised the
                                lockbox banks’ ability to control and monitor visitors’ entrance into and
                                exit from the processing floors. At one location, managers corrected the
                                error before we left; at the other location, managers agreed to correct the
                                error. As a result of these weaknesses, tax receipts and data are exposed to
                                an increased risk of theft from visitors who are not adequately monitored.

Items Brought Into and Out of   The LPGs prohibit individuals from bringing personal belongings, such as
Processing Areas Were Not       purses and shopping bags, into processing areas. The guidelines also
Closely Monitored               prohibit individuals from wearing baggy clothing or bulky outerwear inside
                                processing areas. Guards stationed at the main entrance of processing
                                areas enforce this rule.

                                However, at five lockbox locations, we found that the guards did not
                                effectively monitor individuals entering the processing floors to enforce



                                Page 47                                            GAO-03-299 IRS Lockbox Banks
                            Appendix I
                            Internal Control Weaknesses




                            this requirement. At three of these locations, we observed employees bring
                            personal belongings or wear bulky outerwear inside the processing area. In
                            one instance, a guard brought a purse inside the processing area. At four of
                            these locations, we were able to bring personal belongings, such as purses,
                            into the processing floor and were not challenged by the guards. The
                            guards we interviewed informed us that they either failed to observe
                            personal belongings brought into the processing area or did not know the
                            requirements of the lockbox guidelines concerning personal belongings.

                            Guards are also required to question individuals who attempt to remove
                            property from the lockbox locations. However, at one location, the guards
                            failed to search papers we carried out of the processing area. At another
                            location, we found that on the day of our visit there were no guards present
                            to observe employees leaving the processing area because bank
                            management had not informed the guards that several employees would be
                            working beyond their normal work hours. The guards finished their shift
                            and left before the employees were dismissed.

                            As a result of these security breaches, individuals could have used personal
                            belongings and bulky clothing to conceal and remove tax data and receipts
                            from lockbox locations undetected.

Camera Surveillance Needs   The LPGs require surveillance cameras to be installed at lockbox locations
Improvement                 and security guards to monitor the cameras to observe critical areas, such
                            as the loading docks, secure storage areas, mailroom, and extraction area.
                            However, we found that the camera surveillance at seven lockbox locations
                            we visited could be improved.

                            At two locations, the cameras were stationary and did not have zoom
                            capability to effectively monitor critical areas. At another three locations,
                            camera monitors to survey activities on the processing floor were located
                            in the managers’ offices; however, because of other duties, the managers
                            were frequently on the processing floor and were not able to observe the
                            monitors.34 FMS visited one of these three locations in early 2002 to
                            perform an unannounced security review and also reported this as a
                            finding. Additionally, at another of these three locations, there were no
                            surveillance cameras in the former administrative offices located within


                            34
                             One of these locations also maintained a monitor at the guard station. However, the
                            monitor only surveyed activity at the parking lot and docking area. The monitor used to
                            survey the processing floor was maintained at the site manager’s office.




                            Page 48                                                    GAO-03-299 IRS Lockbox Banks
                                 Appendix I
                                 Internal Control Weaknesses




                                 the processing area. Lockbox managers recently vacated this area and did
                                 not consider installing surveillance cameras because no processing activity
                                 occurred there. However, this area housed unused file cabinets and desks
                                 with drawers where tax data and checks could be hidden. One of the
                                 offices was also used by a computer contractor while on site. At the two
                                 other locations, we found that the monitors used to display the images
                                 from surveillance cameras were ineffective. Specifically, the monitors
                                 displayed up to 16 images on one screen making each individual image
                                 barely visible to effectively monitor or detect illegal activities. Additionally,
                                 since these monitors were visible to employees and visitors, they were
                                 ineffective deterrent controls to those who noticed that the surveillance
                                 could not effectively monitor activities on the processing floor. The images
                                 would be more effective in deterring criminal activities if they were more
                                 visible.

                                 As a result of these weaknesses, lockbox camera surveillance was not
                                 capable of consistently and effectively detecting unusual activity or unsafe
                                 practices and providing early warning of possible security compromises.



Processing Controls Need         In addition to physical security controls, the lockbox guidelines also
Improvement to Better            provide requirements for processing controls to maintain accountability
                                 for, and security over, transactions as they are processed through the
Account for and Protect          normal course of operations. During our visits to lockbox locations, we
Taxpayer Data and Receipts       found deficiencies in processing controls designed to account for or
                                 protect tax data and receipts at several of the lockbox sites. Specifically,
                                 taxpayer information and receipts particularly vulnerable to theft, such as
                                 cash, were not carefully processed and safeguarded. Moreover, the records
                                 to account for items found during candling, a process to detect overlooked
                                 items remaining in envelopes, and cash payments were inadequate to allow
                                 lockbox managers to easily and promptly detect lost or stolen items.

Candling Procedures and Review   To prevent the accidental destruction of taxpayer data and receipts,
Were Not Adequate                lockbox guidelines require envelopes to undergo a candling process. The
                                 LPGs also require lockbox site managers to periodically review the
                                 effectiveness of their site’s candling procedures. During our review of
                                 lockbox operations, we found that at some lockbox locations (1)
                                 deficiencies in the candling processes may lead to the accidental
                                 destruction of tax data and receipts, (2) accounting for found items was
                                 insufficient to detect missing checks within a reasonable time, and (3)
                                 management review of candling processes was either lacking or not clearly
                                 documented.



                                 Page 49                                              GAO-03-299 IRS Lockbox Banks
Appendix I
Internal Control Weaknesses




Inadequate Candling Procedures Could Lead to Accidental
Destruction of Tax Data and Receipts

Lockbox staff open envelopes manually by hand or with the assistance of a
mail extraction machine. Some mail extraction machines slit envelopes on
one side, allow employees to extract their contents, and have the capability
to electronically detect overlooked items remaining in the envelopes. More
advanced machines slit envelopes on three sides and extract the contents.
The method used to open the envelopes determines how the envelopes
should be candled. The LPGs provide guidance on candling procedures and
require all envelopes to be candled twice before destruction. Envelopes
opened with the assistance of a mail extraction machine are considered to
have gone through the first candling.35 After processing, employees are
required to review each envelope through a source of light, such as a
candling table, to determine if any contents remain in the envelope. This is
considered the second candling. For manually opened envelopes,
envelopes that are slit on three sides and flattened sufficiently meet
candling requirements without further light source viewing. Envelopes that
are manually slit on only one side are reviewed twice on the candling table.

During our visits to lockbox locations, we found that at four locations,
envelopes were not sufficiently candled to prevent the accidental
destruction of tax data and receipts because of malfunctioning machines,
careless candling practices, and ineffective candling guidelines.

• At one location, we found two mail extraction machines that
  malfunctioned and failed to detect checks remaining in the envelopes.
  Additionally, some envelopes were only candled once because
  employees often used the mail extraction machines as desks.
  Employees manually opened the envelopes, completely bypassing the
  first candling step to be performed by the machines. These envelopes
  were then candled only once on the candling table. We also observed
  that employees were inattentive when candling envelopes on the
  candling table, allowing envelopes to overlap and making it difficult to
  fully illuminate each envelope or all parts of an envelope.




35
 Based on the LPGs, the first candling occurs when envelopes are processed through the
mail extraction machines. The second required candling occurs on the lighted table used to
perform candling.




Page 50                                                    GAO-03-299 IRS Lockbox Banks
Appendix I
Internal Control Weaknesses




• At a second location, envelopes that were manually opened were not slit
  on three sides or candled twice.

• Two other locations did not properly candle all envelopes because the
  candling requirements in the LPGs do not specify procedures to be used
  with more advanced extraction machines that slit the envelopes on
  three sides and extract the contents. Management at these locations
  believed that because the envelopes were opened on three sides, they
  met the candling guidelines for manually opened envelopes. Therefore,
  they concluded that no further candling was required. However, an IRS
  official subsequently explained that envelopes opened by these types of
  machines should be subject to a second candling until IRS performs a
  study to determine their effectiveness. The fact that we found a $3,300
  check that had not been detected by one of these advanced machines,
  located in another site,36 indicates that they can also malfunction and
  result in the destruction of taxpayer data and receipts. As a result,
  candling procedures did not effectively reduce the risk of accidental
  destruction of tax receipts and data.

Accounting for Items Found During Candling Was Insufficient

Lockbox guidelines require lockbox employees to account for each item
found during candling. Some lockbox locations use two forms to record
items found--an internal candling log and a Form 953537 or equivalent,
which is required to be submitted to the lockbox coordinator each month
for IRS review. Employees prepare the internal log while candling and later
transfer the data onto the Form 9535. Since all items found during candling
must be reported to IRS, the Form 9535 should record the same number
and amounts of checks found as noted on the internal log being maintained
as processing is occurring. However, the lockbox guidelines do not require
a reconciliation of one set of records to the other, nor do they require a
reconciliation of items found during candling to their candling records.

During our review, we found that lockbox banks did not always have
procedures to ensure that all items found were accurately recorded on both


36
 This location candled their envelopes twice even though they used the advanced mail
extraction machine.
37
 Form 9535 is the Record of Lockbox Discovered Remittance and Correspondence. A
discovered remittance is a tax receipt discovered outside the normal check processing
operation, such as during candling.




Page 51                                                    GAO-03-299 IRS Lockbox Banks
Appendix I
Internal Control Weaknesses




sets of logs and that bank managers could not properly account for all
items found. At one location, the two sets of logs that bank management
provided to us could not be reconciled. For example, a check was recorded
on the internal log but not on the Form 9535. Management could not
provide an adequate explanation or documentation to explain the
discrepancy. At this location, we also noted delays of up to 6 days in
transferring records of items found from the internal log to the Form 9535.
Lockbox management explained that because of the volume of work during
the April peak, the Form 9535 could not always be completed or the checks
could not always be processed the same day they were found during
candling. Another location’s internal log only recorded tallies of the
quantity of items found, which did not match the number of items listed on
the log provided to IRS. Because there was not enough information on the
internal log, we could not determine whether items, such as checks,
recorded on the internal log but not on the Form 9535, were ever processed
and credited to the taxpayers’ accounts. We identified this same issue
during a visit to this location in October 2001 as part of our audit of IRS’s
fiscal year 2001 financial statements.38 After this visit, lockbox management
and IRS agreed to address this problem. However, as of April 2002, this
problem had not been corrected. IRS indicated that it plans to address this
issue in the January 2003 revisions to LPGs. At two other locations, we also
found that no reconciliation occurred between items found during candling
and the candling log. As a result of these weaknesses, lockbox management
and IRS may not promptly detect missing checks.

We also noted that the lockbox guidelines do not specifically require the
banks to determine which machine or which extraction clerk39 missed
items that were subsequently found during candling. Such information
would help lockbox bank managers promptly track and repair
malfunctioning machines and provide performance feedback to extraction
clerks.




38
 U.S. General Accounting Office, Management Report: Improvements Needed in IRS’s
Accounting Procedures and Internal Controls, GAO-02-746R (Washington D.C.: July 18,
2002).
39
 An extraction clerk is an individual responsible for manually extracting contents from
envelopes. Due to the nature of the work, extraction clerks are among the first individuals
who handle tax data and receipts at lockbox sites.




Page 52                                                     GAO-03-299 IRS Lockbox Banks
                                Appendix I
                                Internal Control Weaknesses




                                Management Review of Candling Process Was Insufficient or Not
                                Adequately Documented

                                Because IRS officials are not at lockbox locations daily, IRS relies on
                                lockbox managers to ensure that their staff complies with lockbox
                                guidelines. In the case of candling requirements, IRS guidelines require
                                lockbox managers to sample candled items to determine the effectiveness
                                of the candling process and to report results of the reviews to IRS.
                                However, at four locations, we found that lockbox managers, who
                                indicated they had performed these reviews, failed to document or clearly
                                document the results. At two additional locations, managers stated that
                                they did not sample candled envelopes. The manager at one of these
                                locations believed that her frequent observation of the candling process
                                was sufficient to ensure that the envelopes were properly candled. Given
                                the problems we observed with the candling process at several of the
                                locations we visited, management reviews and proper documentation of
                                such reviews are critical to help ensure that problems are promptly
                                identified and corrected.

Controls Were Not in Place to   Lockbox sites receive tax receipts in the form of cash as well as checks.
Adequately Safeguard and        Cash receipts are highly susceptible to theft, and lockbox guidelines have
Account for Cash Receipts       specific requirements for safeguarding and accounting for cash receipts.
                                The guidelines require cash to be stored in locked containers to prevent
                                theft. The keys to these containers must not be left in unsecured places,
                                such as desk drawers. The guidelines also require cash receipts to be
                                recorded on a log. At three lockbox locations, we noted weaknesses in the
                                safeguarding and accounting for cash.

                                At one location, the locked cash box was stored in a locked drawer.
                                However, the keys to both the cash box and the locked drawer were stored
                                in an open drawer because bank management wanted supervisors to have
                                quick access to the cash box to expedite the deposit of cash. At another
                                location, cash for the business and individual tax payments were stored in
                                two separate safes. Three staff members had keys to the safes, which could
                                be opened by individuals acting alone. Additionally, the safe used for
                                business payments was small and moveable. The individual access to the
                                safes and the ease of mobility of one of the safes compromised the security
                                of the stored cash.

                                At two locations, we noted discrepancies between the bank’s safe log and
                                the log that the lockbox managers were required to provide to IRS. A safe
                                log is an internal lockbox document that employees complete before they



                                Page 53                                          GAO-03-299 IRS Lockbox Banks
                              Appendix I
                              Internal Control Weaknesses




                              place cash in the safe or cash box. The safe log should identify the
                              taxpayer, the amount paid, and date cash was discovered. When we
                              reviewed the two sets of logs we found that the dates, amounts, item
                              counts, and taxpayer identification information in the logs did not agree,
                              and bank managers could not reconcile some of the discrepancies. For
                              example, at one location, five items on the safe log were not on the IRS log.
                              One of the items was a $140 cash receipt. Because the safe log did not
                              record taxpayer information for any of the receipts, we could not verify
                              whether the receipt was ever posted to the taxpayer’s account. There is
                              currently no requirement in the LPGs for bank managers to reconcile their
                              internal cash logs to the cash log sent to IRS. Such reconciliation could
                              have quickly detected the discrepancies we noted. Bank management
                              attributed some of these discrepancies to human error, inexperienced staff,
                              and staff failure to take the accounting for cash seriously because the
                              amounts found are typically small. However, individual taxpayers have
                              made cash payments totaling hundreds of dollars. Failure to properly
                              secure and account for cash receipts could result in theft, the untimely
                              detection of theft, inaccurate posting of tax receipts, and unnecessary
                              burden on taxpayers whose cash receipts are lost or incorrectly posted.
                              Therefore, it is critical for lockbox banks to diligently safeguard and
                              account for cash receipts.

Returned Refund Checks Were   Lockbox banks sometimes receive federal tax refund checks that have
Not Adequately Protected      been returned by taxpayers as payment against other tax liabilities. Some
Against Theft                 of these checks have been endorsed by taxpayers and are therefore
                              negotiable. As a safeguard against theft and misuse of returned refund
                              checks, lockbox guidelines require lockbox extraction clerks to promptly
                              stamp a restrictive endorsement on returned refund checks. These checks
                              are subsequently forwarded to IRS for further processing.

                              At seven locations, however, we observed that returned refund checks
                              were not always stamped upon extraction and at some locations were set
                              aside, unsecured, to be stamped later by a different individual. At two
                              locations, we found the returned refund checks without the required
                              stamps ready to be shipped to IRS. Lockbox management attributed many
                              of these exceptions to staff oversight or inadequate training. Several years
                              ago, IRS investigators discovered the theft of seven returned refund checks
                              totaling $300,000 at one IRS Submission Processing Center. Such thefts can
                              also occur at lockbox sites. Thus, it is critical that restrictive endorsements
                              be placed on returned refund checks as soon as they are extracted.




                              Page 54                                             GAO-03-299 IRS Lockbox Banks
                           Appendix I
                           Internal Control Weaknesses




Timely Payments Were       The LPGs, as currently written, have resulted in timely tax payments being
Incorrectly Processed As   processed as delinquent. To determine timeliness, lockbox employees are
Delinquent                 required to examine the postmarks on envelopes in which tax receipts
                           were received. If the postmark indicates that the receipt is delinquent (i.e.,
                           the postmark is subsequent to the return or payment due date), the receipt
                           should be processed as delinquent and the envelope should be attached to
                           the corresponding document and forwarded to IRS. If lockbox employees
                           determine that the receipt is timely (i.e., the postmark is prior to the return
                           or payment due date), the envelope need not be retained. However,
                           beginning with the first day of the month following the month the payment
                           is due, lockbox guidelines require lockbox employees to use the date the
                           mail is received as the transaction date to be recorded in the taxpayer’s
                           account as the payment date. Furthermore, the lockbox guidelines do not
                           require lockbox employees to review and retain the envelopes in which the
                           tax receipts were enclosed.

                           At one lockbox location we visited, we observed that on May 1, 2002,
                           lockbox employees received and extracted tax receipts from two
                           envelopes postmarked prior to or on the April 15 payment due date.
                           Because it was already past the period during which lockbox employees
                           were required to examine postmarks and retain envelopes, lockbox
                           employees processed the payments as delinquent and would have
                           discarded the envelopes even though they were aware that the envelopes
                           were postmarked on or before the payment due date. When we brought
                           these two transactions to the lockbox coordinator’s attention, the lockbox
                           coordinator concluded that, in these instances, the taxpayers had made
                           timely payments. The lockbox coordinator subsequently adjusted the
                           taxpayers’ accounts to reflect these as timely payments. We recognize that
                           careful examination of postmarks on envelopes for all receipts received
                           after the payment due dates slows down the payment processing and we
                           recognize the need to establish reasonable cut-off dates for this review
                           process. However, lockbox employees should immediately seek processing
                           guidance from the lockbox coordinator when incidents such as the ones
                           noted above come to their attention to avoid burdening taxpayers with
                           erroneous penalties and interest for late payments. Additionally, as written,
                           the LPGs could lead to potential taxpayer burden and unnecessary costs to
                           IRS associated with correcting the status of taxpayer’s accounts.




                           Page 55                                             GAO-03-299 IRS Lockbox Banks
                                Appendix I
                                Internal Control Weaknesses




Courier Security Is             Lockbox banks entrust courier employees with transporting thousands of
Inadequate to Protect Tax       pieces of mail containing tax data, cash, checks, and deposits worth
                                millions of dollars per day. Given the susceptibility of these items to theft
Data and Receipts from
                                and loss, it is extremely important that they be carefully safeguarded while
Theft or Loss                   in transit to and from lockbox sites.

                                We previously reported on weaknesses in lockbox courier security and
                                noted that lockbox courier guidelines were not as stringent as IRS courier
                                guidelines.40 For example, unlike IRS courier requirements, the LPGs did
                                not require courier employees to pass a limited background investigation,
                                thus increasing the risk of theft of tax data and receipts by couriers with
                                past criminal histories. The LPGs also did not require lockbox couriers to
                                be insured for $1 million and to travel in pairs while transporting IRS data.
                                In fact, in past audits, we found that lockbox banks used only one courier
                                employee to transport IRS data. These weaknesses in courier security
                                increased the risk of theft and loss of taxpayer data and receipts.

                                In response to our audit findings, IRS enhanced the lockbox courier
                                requirements. The 2002 LPGs now require that couriers used by lockboxes
                                pass favorable FBI fingerprint checks, be bonded for $1 million, travel in
                                pairs, transport IRS data from the lockbox facility to its destination with no
                                stops in between, provide dedicated service to IRS, and lock and attend
                                courier vehicles while IRS data are contained within the vehicles. Despite
                                these enhancements, we and other auditors41 continue to find weaknesses
                                in lockbox courier security because of the lockbox sites’ failure to
                                consistently comply with the revised guidelines. In addition, lockbox
                                courier guidelines could be further refined to improve the security of tax
                                data and receipts.

Couriers Given Access to Tax    IRS recently revised the background screening requirements for lockbox
Data Before Fingerprint Check   couriers. The revised LPGs, effective January 2002, prohibit couriers from
Results Received                having access to IRS data until lockbox managers have received results of
                                their FBI fingerprint checks and resolved any questionable fingerprint




                                40
                                     GAO-02-35.
                                41
                                     TIGTA 2002-30-127.




                                Page 56                                            GAO-03-299 IRS Lockbox Banks
                                 Appendix I
                                 Internal Control Weaknesses




                                 results. However, during a recent TIGTA audit42 of one lockbox site,
                                 auditors found that three couriers were allowed access to taxpayer
                                 information before the lockbox received the results of their fingerprint
                                 checks. Lockbox managers subsequently received results of the FBI
                                 fingerprint checks, which indicated that two of these couriers had criminal
                                 histories. Nevertheless, TIGTA found that lockbox management continued
                                 to allow the two couriers and an additional courier, whose FBI fingerprint
                                 check also indicated a criminal history, access to taxpayer data while
                                 follow-up investigations, which subsequently cleared them, were
                                 underway. TIGTA auditors attributed this weakness to lockbox
                                 management’s failure to develop and implement procedures to ensure that
                                 couriers are granted proper clearance before they receive access to IRS
                                 data.

Lockbox Couriers Not Properly    Lockbox courier standards require courier employees to wear
Identified                       identification badges and lockbox banks to implement procedures to
                                 properly identify couriers. However, at two lockbox locations, we found
                                 that couriers did not wear their identification badges. At one of these
                                 locations, lockbox employees did not verify the courier’s identification
                                 before entrusting him with taxpayer data because the employees indicated
                                 that they were familiar with the courier. Additionally, at this location, the
                                 courier access list, which lists couriers authorized to access tax data and
                                 photo identification of couriers, was maintained at the guard station and
                                 not easily accessible to employees who must verify couriers’ identities
                                 daily. Although not a requirement in the LPGs, some locations have posted
                                 the courier access lists by loading dock doors to facilitate the identification
                                 of couriers. Unless lockbox employees diligently perform their duties to
                                 properly identify couriers, tax receipts and data are exposed to higher risk
                                 of theft from former couriers who have recently been terminated or
                                 unauthorized individuals posing as couriers.

Courier Vehicle Containing Tax   The LPGs require courier vehicles to be locked whenever IRS data are
Data and Receipts Was Not        contained in the vehicle until it reaches its destination. Additionally, the
Locked                           vehicle must always be under the supervision of one of the couriers and
                                 never left unattended. At one lockbox site, we observed that couriers did
                                 not lock the courier vehicle containing tax data. The couriers stated that
                                 they generally did not lock the doors because they never left the IRS
                                 packages unattended. The lockbox guard did not check to see if the vehicle


                                 42
                                      TIGTA 2002-30-127.




                                 Page 57                                             GAO-03-299 IRS Lockbox Banks
                                  Appendix I
                                  Internal Control Weaknesses




                                  was locked because there is no requirement to do so. IRS reviewers also
                                  observed couriers failing to lock courier vehicles during their review of
                                  another lockbox location in April 2002. Failure to ensure that courier
                                  vehicles are locked while in possession of taxpayer data and receipts
                                  increases the risk of loss of such items.

Background Screening of           We also found that background screening requirements continue to be less
Lockbox Couriers Are Less         stringent for lockbox couriers than for IRS couriers. IRS couriers are
Stringent Than Requirements for   subject to both an FBI fingerprint check and a basic background
IRS Couriers                      investigation for contractors before they are given access to tax receipts.
                                  This background investigation includes a check of other federal agency and
                                  defense clearance investigation databases for results of previous
                                  background investigations and a check for any outstanding tax liabilities.
                                  In contrast, lockbox couriers are only required to favorably clear an FBI
                                  fingerprint check and are subject to no further background investigations.
                                  As a result, IRS may not discover information, such as outstanding tax
                                  liabilities, that might cause IRS to deny them access to taxpayer data. IRS is
                                  aware of the risks associated with lockbox couriers and is considering
                                  enhancing the lockbox guidelines to require lockbox couriers to undergo
                                  basic background investigations similar to those required of IRS couriers.

Unauthorized Individuals Not      IRS courier standards specifically prohibit the presence of unauthorized
Prohibited From Courier           individuals in courier vehicles and require IRS personnel to inspect courier
Vehicles                          vehicles daily to ensure that no unauthorized passengers are in the vehicle.
                                  The LPGs, on the other hand, contain no prohibition of unauthorized
                                  individuals in courier vehicles and do not require lockbox staff or guards to
                                  inspect courier vehicles for unauthorized passengers. The guidelines state
                                  only that IRS reserves the right to inspect courier vehicles and drivers.
                                  Because IRS representatives are not on-site every day and there is no
                                  requirement for lockbox employees to inspect vehicles, unauthorized
                                  individuals could ride in courier vehicles and have access to taxpayer data
                                  and receipts without lockbox management’s knowledge.



Further Improvements              Because lockbox employees are entrusted with handling sensitive taxpayer
Needed on Background              information and billions of dollars in receipts annually, ensuring worker
                                  integrity through a carefully managed recruiting and hiring process is an
Screening of Lockbox              area that demands special attention from IRS, FMS, and lockbox
Employees                         management. We previously reported that the screening of permanent and




                                  Page 58                                            GAO-03-299 IRS Lockbox Banks
                             Appendix I
                             Internal Control Weaknesses




                             temporary lockbox employees was inadequate and untimely.43 Specifically,
                             instead of referring to a national database to check for criminal records,
                             lockbox banks limited the screening of criminal background investigations
                             for temporary employees to police records checks in counties that
                             individuals voluntarily disclosed as prior residences. Therefore, the police
                             records checks may be incomplete for some individuals who chose not to
                             disclose counties in which they committed a crime and have criminal
                             records. In addition, lockbox permanent employees were allowed to handle
                             cash, checks, and taxpayer data before their fingerprint checks were
                             completed.

                             IRS management has been responsive to our recommendations and has
                             enhanced its policy on screening of permanent and temporary lockbox
                             employees. The LPGs now require permanent and temporary employees to
                             undergo FBI fingerprint checks. In contrast to the previous police records
                             checks performed by county, FBI fingerprint checks are national in scope.
                             An individual’s fingerprints are matched against fingerprints maintained in
                             the FBI’s national database of criminal records. As a result, criminal
                             records checks performed for lockbox applicants are no longer dependent
                             on the applicant to accurately and completely disclose prior residences.
                             The guidelines have also been updated to prohibit access to taxpayer data
                             and receipts until lockbox management receives the results of an
                             individual’s fingerprint checks. Results that show a possible criminal
                             history must be resolved before the individual in question is allowed access
                             to the lockbox site. The guidelines also require permanent lockbox
                             employees to undergo an appropriate background investigation, as
                             determined by an IRS security officer, in addition to an FBI fingerprint
                             check. Despite these policy improvements, we found that lockbox banks
                             did not always comply with the FBI fingerprint requirements and that
                             further refinements are needed regarding background investigation
                             requirements for lockbox employees.

Employees Given Access to    Based on our review of lockbox personnel files, we found that lockbox
Taxpayer Data and Receipts   banks are generally complying with the new guidelines. However, we and
Before Fingerprint Check     IRS reviewers nonetheless found instances of noncompliance at lockbox
Results Received             banks. This shows a need for IRS and FMS to ensure that lockbox
                             management clearly understand the screening requirements and have
                             implemented effective controls to prevent permanent and temporary


                             43
                                  GAO-02-35.




                             Page 59                                           GAO-03-299 IRS Lockbox Banks
                            Appendix I
                            Internal Control Weaknesses




                            employees’ access to tax data until they have favorably completed an FBI
                            fingerprint check.

                            Specifically at three lockbox locations, we noted noncompliance related to
                            the screening of permanent staff. At one location, we found that 4 out of a
                            nonrepresentative selection of 25 permanent employees whose personnel
                            files we reviewed began working at the lockbox location before bank
                            management received their fingerprint check results. Bank management
                            and IRS personnel explained that this situation occurred because IRS had
                            verbally waived compliance with the screening requirements due to the
                            fact that the bank was experiencing delays in obtaining timely responses on
                            fingerprint checks at the beginning of 2002. At the second location, weak
                            controls to ensure that all employees successfully complete FBI fingerprint
                            checks allowed a permanent bank employee to process receipts and
                            taxpayer data for 3 months before lockbox managers discovered that the
                            employee had not undergone a fingerprint check. The employee was
                            removed from the processing floor until the fingerprint check was
                            completed and approved. At the third location, a permanent employee was
                            allowed to work for several days before the FBI fingerprint check was
                            completed because bank management misunderstood the fingerprint check
                            requirement for lockbox employees. During its April 2002 peak review, IRS
                            officials found similar problems at two other lockbox locations. One
                            location allowed a temporary employee access to tax data before the
                            completion of the employee’s fingerprint check. At the other location, the
                            temporary agencies listed 12 employees as eligible to work, of which 6
                            were already working, even though they had not received their FBI
                            clearance checks or were denied clearance to access tax data.

                            As discussed earlier, taxpayer information and receipts are easily
                            accessible to anyone on the processing floor. Therefore, it is critical for
                            lockbox banks to ensure that these items are properly safeguarded by
                            diligently complying with all aspects of the LPGs, which include screening
                            lockbox employees. Late screening of lockbox employees could result in
                            theft or loss in instances where bank management unknowingly allows
                            individuals with criminal backgrounds access to IRS data and receipts.

Guidelines for Background   The current LPGs require permanent lockbox employees to favorably
Investigations of Lockbox   complete an FBI fingerprint check and an appropriate background
Permanent Employees Need    investigation, as determined by an IRS personnel security officer. However,
Improvement                 the LPGs do not define what is considered an appropriate background
                            investigation for permanent lockbox employees and what information
                            regarding the results of the background investigation should be provided to



                            Page 60                                          GAO-03-299 IRS Lockbox Banks
Appendix I
Internal Control Weaknesses




IRS. As a result, the scope of and documentation for background
investigations performed on permanent lockbox employees varies greatly
among lockbox banks and is not consistent with background investigations
required of other IRS contractors.

According to IRS officials, while some lockbox banks subject their
permanent employees to the required FBI fingerprint check and additional
background investigation, such as county criminal records and credit
history checks, other lockbox banks subject their permanent employees to
FBI fingerprint checks with no further background screening. Additionally,
IRS officials found that investigation results they receive from banks do not
provide adequate information to determine whether the individual should
be allowed access to taxpayer data. For example, background investigation
results may indicate that a criminal records check was completed but not
whether any arrests or convictions were found. Other results of
background investigations may indicate that an arrest or conviction was
found during a criminal records check but not the basis for the arrest or
how recently or frequently the offense occurred. IRS officials also
explained that some lockbox banks could not provide documentation of
results of background investigations performed on their permanent
employees because, as a result of recent bank mergers, lockbox
management did not have access to those records.

According to IRS officials, IRS did not foresee the problems with
background investigations for permanent lockbox employees. As the
variance in the scope of background investigations and in the adequacy of
documentation of their results became evident, IRS made a decision to
accept favorable results of FBI fingerprint checks as the minimum criterion
for allowing permanent lockbox employees access to taxpayer data. As a
result, the level of background screening performed on permanent
employees is inconsistent among lockbox banks and with requirements for
other IRS contractors, such as IRS contracted couriers whose backgrounds
are checked against other investigation databases and for tax liabilities, as
previously discussed. Additionally, permanent employees who were
granted access to tax data based only on the results of favorable FBI
fingerprint checks, in effect, received the same level of background
screening as temporary employees and less than that of IRS contracted
couriers, even though permanent employees have more influence and
authority over lockbox operations, and are granted more access rights to
various sections of the lockbox sites. Because some banks subject their
permanent employees to less scrutiny when performing background
investigations than other banks, IRS may not be aware of critical



Page 61                                           GAO-03-299 IRS Lockbox Banks
                                 Appendix I
                                 Internal Control Weaknesses




                                 information that could have been uncovered by a more thorough
                                 background investigation, such as recent criminal records not yet reported
                                 to the FBI, which might cause IRS to deny them access to taxpayer data.

FBI Checks May Be Inadequate     TIGTA auditors recently reported that lockbox banks often employ non-
for Lockbox Employees Who        U.S. citizens with lawful permanent residence to process IRS tax
Have Recently Established        payments.44 Although the IRS hires only U.S. citizens, IRS and FMS have
Residency in the United States   allowed lockbox banks to hire non-U.S. citizens. TIGTA auditors found this
                                 policy to be consistent with guidelines from the Department of the
                                 Treasury regarding the hiring of contract employees. However, this hiring
                                 practice may pose unnecessary risks to IRS materials because the FBI
                                 fingerprint check, which is national in scope, may have very little
                                 information to disclose if these individuals lived in this country for only a
                                 short period of time. The Department of State and the Immigration and
                                 Naturalization Service perform some background checks before issuing
                                 visas to nonresidents or upgrading visas that may allow individuals to
                                 achieve lawful permanent resident status. However, neither the TIGTA
                                 auditors nor the IRS know the extent of these background checks. In
                                 response to this finding, IRS agreed to form a task group to review the
                                 current standards. If IRS determines that the standards do not provide
                                 adequate protection or the risk is not reduced by other security measures,
                                 IRS will incorporate more stringent requirements into the LPGs after
                                 coordinating with FMS and the Department of the Treasury. The
                                 uncertainty of criminal histories of non-U.S. citizens hired by lockbox
                                 banks may lead to hiring of individuals with criminal histories which, in
                                 turn, increases the risk of theft of receipts or misuse of tax data. For
                                 instance, TIGTA auditors reported that evidence regarding the theft of
                                 checks from one lockbox site indicates the involvement of a crime ring
                                 from a foreign country in the negotiation of and possibly in the actual theft
                                 of taxpayer checks.




                                 44
                                      TIGTA 2002-30-180.




                                 Page 62                                           GAO-03-299 IRS Lockbox Banks
Appendix II

GAO Analysis of IRS’s and FMS’s August 1999
1040 Tax Payment Comparative Cost Benefit
Study                                                                                                     Appendx
                                                                                                                iI




              In August 1999, an IRS/FMS taskforce issued a study entitled 1040 Tax
              Payment Comparative Cost Benefit Study. The study estimated the costs
              and interest savings from processing Form 1040 tax receipts at IRS
              compared to lockbox banks using three different IRS scenarios. Table 3
              shows the IRS/FMS taskforce results for all three IRS scenarios for each of
              7 fiscal years (fiscal years 2001 through 2007) and overall.



              Table 3: IRS and Lockbox Banks Cost and Saving Estimates for the Federal
              Government, Fiscal Years 2001 through 2007


              Dollars in thousands
              IRS scenarios                                      Scenario I     Scenario II    Scenario III
              IRS processing costs                                  $55,958        $59,597        $52,408
              Lockbox bank processing costs                       (144,879)       (144,879)      (144,879)
              Interest float saving from lockbox
              banks                                                 100,523        217,897        978,637
              Net savings from using lockbox
              banks                                                 $11,603       $132,615       $886,166
              Source: GAO analysis of 1999 IRS/FMS study.

              Note: Totals for net savings may not add due to rounding.


              All three IRS scenarios used the same estimated lockbox bank processing
              costs of $144.9 million. IRS interest float savings and processing costs
              varied because assumptions differed across scenarios. Scenario I estimated
              a 1.384 interest float savings while scenarios II and III used 3 days and 10.6
              days, respectively. Processing costs for scenario I assumed additional
              processing equipment, additional staff, additional space, and a 10 percent
              increase in processing productivity. Scenario II assumptions were the same
              as I except for assuming no increase in processing productivity. Scenario III
              assumptions were the same as II except for assuming no additional
              processing equipment, staff, or space.

              We focused on IRS scenario I for further analysis because it was the one
              used to justify the decision to continue using lockbox banks to process tax
              receipts. Table 4 shows the IRS/FMS taskforce results for scenario I in
              more detail for each of 7 fiscal years (2001 through 2007).




              Page 63                                                         GAO-03-299 IRS Lockbox Banks
                                            Appendix II
                                            GAO Analysis of IRS’s and FMS’s August 1999
                                            1040 Tax Payment Comparative Cost Benefit
                                            Study




Table 4: IRS and Lockbox Banks Cost and Saving Estimates Under IRS Scenario I for the Federal Government, Fiscal Years 2001
through 2007

Dollars in thousands
                                                                                          Fiscal Year
Cost category                       2001               2002            2003                2004          2005        2006          2007            Total
IRS costs
Labora                            $5,289             $5,676          $6,210               $6,625        $7,056     $7,507         $7,978         $46,341
Basic supportb                       292                308              331                348           365         383           400           $2,427
Equipment depreciation             1,318              1,318           1,318                1,318         1,318          0              0          $6,590
Site preparation depreciation        120                120              120                120           120           0              0           $600
Total IRS processing cost         $7,018             $7,422          $7,980               $8,411        $8,859     $7,890         $8,378         $55,958
Lockbox bank costs
Basic and standardc              $10,671           $10,916         $11,584           $12,077        $12,579       $13,092      $13,616           $84,535
Ancillaryd                         7,617              7,792           8,269                8,621         8,979      9,345          9,720         $60,344
Total lockbox bank cost          $18,288           $18,709         $19,853           $20,698        $21,558       $22,437      $23,336          $144,879
Cost difference: Lockbox bank
compared to IRS                 ($11,270)        ($11,286)       ($11,874)         ($12,287)       ($12,699)     ($14,548)   ($14,957)       ($88,921)
Interest saving difference:
Lockbox bank compared to
IRS                              $12,518           $13,074         $13,846           $14,407        $14,976       $15,556      $16,146          $100,523
Net saving                        $1,248             $1,787          $1,973               $2,120        $2,277     $1,008         $1,188         $11,603
                                            Source: GAO analysis of 1999 IRS/FMS study.

                                            Note: Totals may not add due to rounding.
                                            a
                                                Labor includes costs to sort, process, and deposit tax receipts plus benefits, overhead, and inflation.
                                            b
                                                Basic support includes costs for service and supplies, equipment, and printing.
                                            c
                                                Basic and standard includes costs for depositing tax receipts in the bank.
                                            d
                                                Ancillary includes costs for other services, such as sorting and shipping tax returns to IRS.


                                            We analyzed the documented support for the data used to develop
                                            estimates in the study. The support often came from historical data on
                                            lockbox banks and IRS’s processing. We generally found some documented
                                            support on the methodology and assumptions used for the costs and
                                            revenue estimates. We could not compare support for the specific cost
                                            estimates, however, because the lockbox banks only had a basic charge for
                                            processing tax receipts and an additional charge to sort tax returns and
                                            ship them to IRS.




                                            Page 64                                                                  GAO-03-299 IRS Lockbox Banks
Appendix II
GAO Analysis of IRS’s and FMS’s August 1999
1040 Tax Payment Comparative Cost Benefit
Study




The estimation methodology and assumptions used in the study were the
same for each year. To illustrate the methodology and assumptions, we
reviewed how the estimates were developed for the first year—fiscal year
2001. For example, as shown in table 4, the net saving of $1.2 million is the
difference between IRS and lockbox bank costs and IRS and lockbox bank
interest savings. For costs, the study estimated that processing the tax
receipts through lockbox banks would cost $11.3 million more than
processing them through IRS. For interest savings, the study estimated that
using lockbox banks would save $12.5 million more than using IRS.

For cost estimates, a key factor was the estimated number of tax receipts,
which was based on the actual number of 1998 tax receipts and projected
for future years using expected growth rates. To understand IRS’s costs for
fiscal year 2001, we analyzed its four components—labor costs, basic
support costs, equipment depreciation, and site preparation depreciation.
A discussion of each of the four cost components follows.

IRS labor costs were often estimated from IRS’s Cost Estimate Reference
guide that provides estimated costs for particular activities at IRS.45 The
guide includes estimated labor cost and staff hours for processing tax
returns.46 We traced each cost estimate in the study to the IRS cost guide.
We also discussed the cost estimates with the IRS analyst who made and
documented the computations for the study. Table 5 breaks down the IRS
labor cost estimate for fiscal year 2001.




45
 Internal Revenue Service, Cost Estimate Reference, Document 6746, revision November
1998.
46
 We made no attempt to analyze IRS’s data collection systems that support the data in the
cost guide.




Page 65                                                    GAO-03-299 IRS Lockbox Banks
Appendix II
GAO Analysis of IRS’s and FMS’s August 1999
1040 Tax Payment Comparative Cost Benefit
Study




Table 5: IRS’s Fiscal Year 2001 Labor Cost

                                                       Rate per     Staff      Hourly
Activity                                      Volume      hour     hours     staff pay              Cost
Sorting returns                           10,093,903     103.9    97,150          $9.24        $897,666
Processing receipts                       7,831,622a     171.4    45,692        $10.24         $467,886
Depositing receipts                       10,093,903     267.9    37,678        $10.17         $383,185
Quality assuranceb                                                              $13.94          $80,531
               c
Overhead                                                                        $13.81      $1,862,679
Benefitsd                                                                                      $886,067
                     e
Labor inflation                                                                               $710,651
Total labor cost                                                                            $5,288,665
Source: GAO analysis of the 1999 study estimates.
a
 Processing tax receipts involves a lower volume because the study estimated IRS could process
2,262,281 more receipts without a cost impact, assuming an estimated 10 percent productivity
increase from using new processing equipment.
b
 Quality assurance cost is computed by multiplying the staff hours for sorting, processing, and
depositing (180,520 hours) by 3.2 percent and by $13.94 hourly staff pay (factors from IRS cost guide).
c
 Overhead cost is computed by multiplying staff hours for sorting, processing, depositing, and quality
assurance (186,297 hours) by 72.4 percent and by $13.81 hourly staff pay (factors from IRS cost
guide).
d
 Benefits are computed by adding the costs for the first five activities and multiplying by 24 percent
(benefit rate from IRS cost guide).
e
 Labor inflation is estimated from federal pay increases, with a compounded rate of 15.5 percent
through fiscal year 2001 applied to the cost of the first six activities ($4,578,014).


Explanations of the other three components in IRS’s processing cost
estimates follow.

• Basic support cost: $291,679
  Consists of service and supplies, equipment, and printing on the basis of
  rates listed in the IRS cost guide.

• Equipment depreciation: $1,317,796
  IRS would need to spend an estimated $6,588,980 on hardware,
  furniture, and software if IRS processed Form 1040 tax receipts instead
  of lockbox banks. This cost was depreciated over a 5-year period in
  equal annual amounts.




Page 66                                                              GAO-03-299 IRS Lockbox Banks
Appendix II
GAO Analysis of IRS’s and FMS’s August 1999
1040 Tax Payment Comparative Cost Benefit
Study




• Site preparation depreciation: $120,000
  IRS would need to spend $600,000—$300,000 at each of two IRS
  locations—to prepare space to accommodate new equipment required
  to process the increased volume of tax receipts. This cost was
  depreciated over a 5-year period in equal annual amounts.

We also analyzed the added interest savings if lockbox banks processed the
tax receipts instead of IRS. The IRS/FMS taskforce study followed a
formula in Treasury regulations to compute this estimate. For fiscal year
2001, the factors in that formula included

• total tax receipts = $45,224,421,259 divided by

• total deposit days of 250 multiplied by

• interest float of 1.384 days multiplied by

• an estimated federal funds rate of 5 percent.

The number of deposit days was specified in the Treasury regulations. The
interest float represents how much faster lockbox banks could process tax
receipts compared to IRS in three areas, totaling 1.384 days:

• Mail float 0.035 days

• Availability float 0.349 days

• Compressing the program completion date (PCD) 1.000 day

Mail float is measured from the time a taxpayer mails a payment until it
arrives at a lockbox bank or IRS. Availability float is measured from the
time a receipt is deposited until the funds are credited to the Treasury. The
PCD is the day when lockbox banks must finish processing during peak
workload periods and return to a schedule of depositing receipts within 24
hours.

We examined the basis for each of these three estimates. Mail and
availability float figures were taken from a July 1998 interest float study
done by a contractor for FMS. The PCD figure came from an agreement by
lockbox banks to compress PCD by 1 day while the study concluded that
IRS could not match the compression for a number of reasons. A new
interest float study would have to be done to know the actual float



Page 67                                             GAO-03-299 IRS Lockbox Banks
Appendix II
GAO Analysis of IRS’s and FMS’s August 1999
1040 Tax Payment Comparative Cost Benefit
Study




advantage, if any, from using lockbox banks rather than IRS to process the
tax receipts.




Page 68                                         GAO-03-299 IRS Lockbox Banks
Appendix III

Comments from the Department of the
Treasury                                                             Appendx
                                                                           Ii




Note: GAO comments
supplementing those in the
report text appear at the end
of this appendix.




See comment 1.




                                Page 69   GAO-03-299 IRS Lockbox Banks
                 Appendix III
                 Comments from the Department of the
                 Treasury




See comment 2.




See comment 1.




                 Page 70                               GAO-03-299 IRS Lockbox Banks
Appendix III
Comments from the Department of the
Treasury




Page 71                               GAO-03-299 IRS Lockbox Banks
Appendix III
Comments from the Department of the
Treasury




Page 72                               GAO-03-299 IRS Lockbox Banks
Appendix III
Comments from the Department of the
Treasury




Page 73                               GAO-03-299 IRS Lockbox Banks
Appendix III
Comments from the Department of the
Treasury




Page 74                               GAO-03-299 IRS Lockbox Banks
               Appendix III
               Comments from the Department of the
               Treasury




               The following are GAO’s comments on the Department of the Treasury’s
               letter dated December 20, 2002.



GAO Comments   1. See “Agency Comments and Our Evaluation” section.

               2. IRS and FMS indicated the need for one technical clarification
                  regarding our use of the terms “contracts,” “contractor,” and
                  “contractual agreements” with respect to lockbox banks and
                  recommended that we delete all references to “contracts” and
                  “contractors.” IRS and FMS stated that when lockbox banks perform
                  services for IRS, they act in a financial agent capacity on behalf of
                  Treasury and that this function does not constitute a procurement or
                  contract within the meaning of the Federal Property and Administrative
                  Services Act or the Federal Acquisition Regulation (FAR). We recognize
                  that the lockbox agreements are not procurements for purposes of the
                  act or the FAR, but we did not change the language used in the report
                  for ease of reference. It should be noted that Treasury also uses
                  contract terminology in discussing lockbox agreements. Specifically,
                  the Treasury Financial Manual gives FMS “the exclusive authority to
                  contract for lockbox services with the selected bank and the agency”
                  and further states that “an agency is prohibited from entering into new
                  contractual agreements … without the prior approval of FMS.” In
                  addition, in the IRM, IRS defines a lockbox depositary agreement as a
                  “contractual agreement signed by IRS, FMS and the Lockbox that
                  provides the requirements of the activities performed as the
                  commercial depositories.” Our use of contract terminology in this
                  report is consistent with Treasury’s use of such terminology in the TFM
                  and the IRM. We did add a footnote (see footnote 2) to clarify that while
                  the agreements with the lockbox banks are legally binding, they are not
                  procurements subject to the provisions of the Federal Property and
                  Administrative Services Act or the FAR, and to indicate that we use the
                  terms “contracts” and “contractors” in the report for ease of reference.




               Page 75                                           GAO-03-299 IRS Lockbox Banks
Appendix IV

GAO Contacts and Staff Acknowledgments                                                        Appendx
                                                                                                    i
                                                                                                    IV




GAO Contacts      Steve Sebastian (202) 512-3406
                  Mike Brostek (202) 512-9110



Acknowledgments   In addition to those named above, Larry Dandridge, Marshall Hamlett,
                  Aaron Holling, Jeffrey Jacobson, Casey Keplinger, Laurie King, Delores Lee,
                  Yola Lewis, Larry Malenich, Julia Matta, Tom Short, and Esther Tepper
                  made key contributions to this report.




(191024)          Page 76                                          GAO-03-299 IRS Lockbox Banks
GAO’s Mission            The General Accounting Office, the investigative arm of Congress, exists to
                         support Congress in meeting its constitutional responsibilities and to help improve
                         the performance and accountability of the federal government for the American
                         people. GAO examines the use of public funds; evaluates federal programs and
                         policies; and provides analyses, recommendations, and other assistance to help
                         Congress make informed oversight, policy, and funding decisions. GAO’s
                         commitment to good government is reflected in its core values of accountability,
                         integrity, and reliability.


Obtaining Copies of      The fastest and easiest way to obtain copies of GAO documents at no cost is
                         through the Internet. GAO’s Web site (www.gao.gov) contains abstracts and full-
GAO Reports and          text files of current reports and testimony and an expanding archive of older
                         products. The Web site features a search engine to help you locate documents
Testimony                using key words and phrases. You can print these documents in their entirety,
                         including charts and other graphics.
                         Each day, GAO issues a list of newly released reports, testimony, and
                         correspondence. GAO posts this list, known as “Today’s Reports,” on its Web site
                         daily. The list contains links to the full-text document files. To have GAO e-mail this
                         list to you every afternoon, go to www.gao.gov and select “Subscribe to GAO
                         Mailing Lists” under “Order GAO Products” heading.


Order by Mail or Phone   The first copy of each printed report is free. Additional copies are $2 each. A check
                         or money order should be made out to the Superintendent of Documents. GAO
                         also accepts VISA and Mastercard. Orders for 100 or more copies mailed to a single
                         address are discounted 25 percent. Orders should be sent to:
                         U.S. General Accounting Office
                         441 G Street NW, Room LM
                         Washington, D.C. 20548
                         To order by Phone:     Voice: (202) 512-6000
                                                TDD: (202) 512-2537
                                                Fax: (202) 512-6061


To Report Fraud,         Contact:
                         Web site: www.gao.gov/fraudnet/fraudnet.htm
Waste, and Abuse in      E-mail: fraudnet@gao.gov
Federal Programs         Automated answering system: (800) 424-5454 or (202) 512-7470



Public Affairs           Jeff Nelligan, Managing Director, NelliganJ@gao.gov (202) 512-4800
                         U.S. General Accounting Office, 441 G Street NW, Room 7149
                         Washington, D.C. 20548
United States                  Presorted Standard
General Accounting Office      Postage & Fees Paid
Washington, D.C. 20548-0001           GAO
                                 Permit No. GI00
Official Business
Penalty for Private Use $300

Address Service Requested