recommended reading

IRS slow reaction to bounced checks costs treasury $20 million

The Internal Revenue Service issued more than $20 million in refunds in error because it realized too late that individuals who overpaid taxes owed did so using bad checks, according to a report released by the Treasury inspector general for tax administration on Tuesday.

The inspector general issued a second report on Tuesday that found IRS managers needed to be more consistent in reviewing security reports to detect potential unauthorized accesses to taxpayer accounts by agency employees.

In its first report, the inspector general found that during the 2008 tax season, the IRS had 245,007 checks totaling $1.55 billion returned because of insufficient funds or other issues. Of those checks, 15,823 were written for a larger amount than the taxpayer owed, which resulted in the IRS automatically generating $53 million in refunds before officials realized that the payment checks were no good. The IRS was able to stop payment on about 8 percent of the $53 million in refunds, but more than $20 million was cashed.

Less than 1 percent of all payments the agency processes are in error, and "weaknesses in the IRS' dishonored check processing put millions of dollars at risk," the inspector general said.

To prevent erroneous refunds, IRS guidelines require tax examiners to adjust account information and to stop payment on refunds, as needed, within 21 days of a bank notification that a check is no good. But in a review of sample taxpayers' accounts, the IG found that 55 percent of bounced checks were not properly addressed within that time frame. About 60 percent of the time, tax examiners did not begin to address the bad checks until after the refund was erroneously generated, and they took as many as 47 days to reverse the payment after learning a check bounced.

"The IRS should implement computer controls to prevent refunds of overpayments from posting to a taxpayer's account until it is reasonably assured the related payment has cleared the bank," noted the inspector general, who determined that a freeze on refunds for 21 days would provide enough time for the IRS to determine if the payment did not go through. This system could protect more than $20 million a year and almost $102 million during the next five years from being issued to taxpayers in error, according to the report. Systemically stopping refunds on bad checks also could allow the IRS to redirect $119,308 per year, which is used to recover erroneous refunds, to other purposes.

The IRS' commissioner of its wage and investment division agreed to develop a system to identify erroneous refunds paid on bounced checks, contingent on funding. The IRS also said it would recover refunds that were erroneously issued during the 2008 and 2009 calendar years.

In the long term, the inspector general also recommended that the IRS modify its payment processing system to convert the paper checks taxpayers receive into electronic fund withdrawals, which would allow automatic authorization from the bank and notification if the payment could not be honored.

Currently, however, the Treasury Department's Electronic Federal Tax Payment System does not have the functionality to allow the IRS to convert paper checks to an electronic format for transmitting to banks.

In its second audit, the inspector general found that the IRS needed to do more to ensure that taxpayers' accounts are protected from unauthorized access by agency employees.

In fiscal 2008, 11 percent of the security reports generated by the Integrated Data Retrieval System, which maintains taxpayers' names, Social Security numbers, birth dates, addresses, filing statuses, exemptions and income, were not reviewed and certified by IRS managers. The security reports summarize audit trail information that can be used to detect potential unauthorized accesses to accounts.

The IDRS Online Reports Services system, which is a Web-based application for authorized reviewers, notifies managers by e-mail when security reports are available and when responses to reports are due. Of the 325,475 security reports in fiscal 2008 requiring certification by IDRS managers, 89 percent were certified. That was an improvement from fiscal 2005, when the IG reported that only 54 percent of IDRS security reports were certified. Nonetheless, the IG identified 36,493 reports that were not reviewed and certified, "potentially allowing improper accesses to go undetected."

IRS management agreed to develop and implement compliance review procedures for IDRS security officers, and hold managers accountable when they fail to meet their requirements for reviewing security reports. A memorandum also will be released reiterating IDRS security program policy requirements.

Threatwatch Alert

Thousands of cyber attacks occur each day

See the latest threats


Close [ x ] More from Nextgov

Thank you for subscribing to newsletters from
We think these reports might interest you:

  • Featured Content from RSA Conference: Dissed by NIST

    Learn more about the latest draft of the U.S. National Institute of Standards and Technology guidance document on authentication and lifecycle management.

  • PIV- I And Multifactor Authentication: The Best Defense for Federal Government Contractors

    This white paper explores NIST SP 800-171 and why compliance is critical to federal government contractors, especially those that work with the Department of Defense, as well as how leveraging PIV-I credentialing with multifactor authentication can be used as a defense against cyberattacks

  • Toward A More Innovative Government

    This research study aims to understand how state and local leaders regard their agency’s innovation efforts and what they are doing to overcome the challenges they face in successfully implementing these efforts.

  • From Volume to Value: UK’s NHS Digital Provides U.S. Healthcare Agencies A Roadmap For Value-Based Payment Models

    The U.S. healthcare industry is rapidly moving away from traditional fee-for-service models and towards value-based purchasing that reimburses physicians for quality of care in place of frequency of care.

  • GBC Flash Poll: Is Your Agency Safe?

    Federal leaders weigh in on the state of information security

  • Data-Centric Security vs. Database-Level Security

    Database-level encryption had its origins in the 1990s and early 2000s in response to very basic risks which largely revolved around the theft of servers, backup tapes and other physical-layer assets. As noted in Verizon’s 2014, Data Breach Investigations Report (DBIR)1, threats today are far more advanced and dangerous.


When you download a report, your information may be shared with the underwriters of that document.