Background Detecting IDT Refund Fraud Is Challenging Over the past decade, our prior work has highlighted the evolving nature of individual IDT refund fraud and the challenges IRS faces in keeping up with fraudsters’ tactics. Since 2015, our biennial High-Risk Report has highlighted the challenges associated with IDT refund fraud, the actions IRS needs to take to address them, and the cybersecurity issue of protecting PII amid large-scale data breaches. These challenges are relevant to business IDT and further compounded by the complexity of the business tax environment. According to IRS officials, this complexity stems, in part, from the number of business types or structures, the various taxes that businesses pay, and the different tax forms businesses must file. Further, many businesses file tax returns throughout the year, unlike individual taxpayers who generally file income tax returns once a year. These factors make detecting, researching, and resolving potential business IDT cases more challenging than individual IDT cases. When establishing a business, a business owner must determine the structure of the business for tax purposes, among other things, and may link business entities together in networks with multiple tiers. In addition, unlike individuals, businesses are required to pay different types of taxes depending on the business structure. For example, C corporations and S corporations pay income tax, and may also pay employment taxes and excise taxes on certain products and services such as fuel. Businesses are required to file different forms for each type of tax and may also file forms to claim various tax credits. Table 1 provides examples of business types and associated tax forms, volume, and total refunds for fiscal year 2018. IRS officials said that the complexity of the business tax environment makes it difficult for tax examiners to distinguish between true business IDT and frivolous tax arguments or noncompliance, such as incorrect or missing information on a form. Officials also noted that fraudsters may be attracted to the potential large payout associated with business tax refunds. According to IRS data, the average 2018 tax refund for corporations was about $286,200 and about $24,700 for estates and trusts. In contrast, the IRS Data Book, 2018 reports that the average individual tax refund was about $2,900. Further, business IDT may also lead to other types of tax fraud. In addition to filing false business returns seeking a refund, fraudsters may use stolen EINs and business information to support an individual income tax refund scheme. For example, fraudsters may file fraudulent Forms W- 2, Wage and Tax Statement with information on fictitious employees. These forms could then be used to file fraudulent individual tax returns seeking refunds. Business IDT Can Occur in Two Ways According to IRS, there are two ways a fraudster can commit business IDT, both of which involve the fraudulent use of the EIN. 1. Obtain an existing EIN. In this scenario, a fraudster obtains federal tax information from an existing business (see fig. 1). The business may be active or dormant, meaning that the business owner has not filed a tax return for at least two tax periods. The fraudster then uses the EIN and other key business information to file a fraudulent business return, such as Form 1120. 2. Fabricate an EIN. In this scenario, a fraudster steals the identifying information of an individual, such as a Social Security number and uses it to apply for an EIN. The fraudster would then use the fabricated EIN to complete and file false business returns. Federal Agencies Are Required to Identify, Assess, and Manage Fraud Risks In June 2016, Congress passed and the President signed into law the Fraud Reduction and Data Analytics Act of 2015 (FRDAA), which created requirements for agencies to establish financial and administrative controls for managing fraud risks. These requirements are aligned with leading practices outlined in our Fraud Risk Framework. In addition, guidance from OMB affirms that managers should adhere to the leading practices identified in the framework. The Fraud Risk Framework provides key components and leading practices for agency managers to use when developing efforts to combat fraud in a strategic, risk-based way. The framework consists of four primary components of fraud risk management: commit, assess, design and implement, and evaluate and adapt, as shown in figure 2. Specifically, the components call for agencies to (1) commit to combatting fraud by creating an organizational culture conducive to fraud risk management, (2) plan regular fraud risk assessments and assess risks to determine a fraud risk profile, (3) design and implement a strategy with specific control activities to mitigate assessed fraud risks, and (4) evaluate outcomes using a risk-based approach and adapt activities to improve fraud risk management. According to the Fraud Risk Framework, the four components are interdependent and mutually reinforcing. For example, fraud response efforts can inform preventive activities, such as using the results of investigations to enhance fraud detection efforts. We have previously reported that preventive activities generally offer the most cost-efficient use of resources, since they enable managers to avoid a costly and inefficient “pay-and-chase” model. The framework also reflects ongoing activities for monitoring and feedback that apply to all four components. IRS Uses Fraud Filters and Collaborates with External Partners to Detect Business IDT IRS uses computerized checks, or fraud filters, to screen incoming tax returns for known or suspected characteristics of fraud. As of September 2019, IRS had implemented 19 unique fraud filters that assess incoming returns on certain business and employment tax forms. These fraud filters help IRS determine if an incoming return exhibits suspicious characteristics. IRS also cross-references these returns against lists of taxpayer identification numbers previously involved in data breaches and at greater risk of tax-related identity theft. IRS officials stated that they plan to implement additional fraud filters for three employment tax forms for the 2020 filing season. Our analysis of IRS’s data shows that from January 2017 to August 2019, business IDT fraud filters stopped about 188,500 incoming business returns as potential IDT, claiming $47.6 billion in refunds. Of these, IRS performed in-depth research on about 182,700 returns claiming $47.3 billion in refunds. IRS determined that about 77 percent of these cases (140,100 cases) claiming $38.3 billion in refunds were not business IDT while about 4 percent (7,900 cases) were confirmed business IDT claiming $384 million in fraudulent refunds. The remaining cases were still under review as of August 2019. However, as we discuss later in this report, these estimates do not capture the full size and scope of business IDT. In addition to developing fraud filters, IRS has established more advanced fraud detection efforts through the Return Review Program (RRP). As of September 2019, IRS was developing and testing fraud detection models in RRP for certain business tax forms. IRS officials said they intend to develop additional models, such as those to address fuel tax credit fraud and entity fabrication. Officials also noted that they will continue to rely on fraud filters to detect potentially fraudulent business returns, even after expanding RRP’s functionality. Further, IRS’s broader fraud detection efforts include working with external partners. For example, IRS collaborates with states and industry partners through the Security Summit Business IDT sub-workgroup. This group has identified business-related data elements that are captured during the tax filing process and analyzed for potential suspicious patterns that could indicate business IDT. During the 2018 filing season, IRS analyzed 37 data elements from incoming business tax returns and 10 data elements on incoming employment tax returns, including, for example, characteristics of the computer used to submit the return. IRS officials also stated that they are working directly with tax practitioners to help improve the quality of the data they collect to better inform future business IDT fraud filters and models. In addition, in December 2017, IRS initiated a pilot project with the Alabama Department of Labor to help detect and prevent business IDT. IRS officials stated that they send the department a data extract on all newly issued EINs from the prior month. The state performs research on these businesses and, in turn, sends IRS a list of businesses that it has determined to be fraudulent. As a result, IRS is able to deactivate the fraudulent EINs before the fraudster files a false business, employment, or individual tax return claiming a refund. This allows IRS to reject returns associated with the fraudulent EINs. According to IRS data, in 2018 IRS identified about 3 percent (1,343 out of 53,826) of new EINs in Alabama as fraudulent. The early results of this collaborative effort indicate that this project shows promise, and IRS officials stated that they are working to determine if they can expand the initiative to other states. IRS Has Taken Some Steps to Identify Business IDT Risks, but Efforts Are Not Fully Aligned with Selected Fraud Risk Management Leading Practices IRS Has Developed an Organizational Culture to Help Combat Fraud, but Lacks a Designated Entity to Oversee Business IDT Efforts One component of our Fraud Risk Framework calls for agencies to create an organizational culture conducive to combating fraud. Such a culture can be created through “tone at the top,” whereby senior-level staff demonstrate commitment to integrity and combating fraud, and actions that involve all levels of the agency in setting an antifraud tone that permeates the organization. In addition, the Fraud Risk Framework calls for agencies to designate an entity to lead fraud risk management activities. Among other things, the designated entity should have defined responsibilities and the necessary authority to perform its role, including managing a fraud risk assessment process and coordinating antifraud activities across the program. Our prior work has shown that when agencies formally designate an entity to design and oversee fraud risk management activities, their efforts can be more visible across the agency, particularly to executive leadership. Consistent with the Fraud Risk Framework, IRS leadership has demonstrated a commitment to identifying and combating overall IDT refund fraud. For example, the agency has recognized the broad and evolving challenge of IDT refund fraud in its fiscal year 2018–2022 strategic plan. Also, as previously discussed, IRS has expanded its fraud detection activities to prevent payment of fraudulent refunds, including refunds on business-related returns. In addition, our 2019 High-Risk Report noted that IRS took significant actions to facilitate information sharing with states and industry partners through the Identity Theft Tax Refund Fraud Information Sharing and Analysis Center. Further, IRS has implemented agency-wide antifraud efforts, including bringing officials together from across the organization to discuss potential fraud risks. These efforts have helped to foster an antifraud tone across IRS, according to IRS officials. At the business unit level, four IRS entities have responsibility for detecting, preventing, and resolving business IDT, as described below. However, IRS has not designated a lead entity to design and oversee business IDT fraud risk management activities across the agency, including a fraud risk assessment, consistent with leading practices. During our interviews with IRS, we found that IRS officials were knowledgeable about the business IDT policies, processes, and outcomes in their individual unit. However, none of the entities has defined responsibilities and the necessary authority to manage fraud risk across the business units. Further, no one we spoke with could articulate an agency-wide view of the problem and its potential impact on IRS. Return Integrity and Compliance Services (RICS) is responsible for detecting potential fraud on incoming business tax returns during the “pre-refund” phase (i.e., the period from when IRS accepts the return but before it issues a refund). About 20 RICS and Integrity and Verification Operations tax examiners are responsible for researching taxpayer accounts to confirm whether or not business IDT occurred. Tax examiners are also responsible for resolving cases to both prevent IRS from paying out fraudulent refunds and ensure that legitimate taxpayers’ returns are released for processing. RICS refers cases to other IRS units if the case shows other signs of fraud, such as a frivolous return. Accounts Management (AM) is responsible for researching and resolving potential business IDT cases identified during the “post- refund” phase (i.e., after a refund has been paid). AM customer service representatives perform in-depth account research and work with taxpayers to determine if business IDT has occurred. In cases of confirmed business IDT, AM corrects related account errors and enters appropriate IDT markers on the taxpayer’s account. According to IRS officials, about five AM staff work on business IDT cases one day a week or as needed. Criminal Investigation (CI) investigates large-scale tax schemes and other financial fraud, including fraud related to IDT. Office of Research, Applied Analytics and Statistics (RAAS) is responsible for supporting RICS and other business units in identifying and developing various business IDT fraud detection capabilities. RAAS also performs analyses to help IRS determine how best to proceed with other fraud detection and prevention efforts. IRS officials stated that representatives from the four business units meet regularly to share information on cases and discuss challenges. Further, IRS officials stated that the IDT Executive Steering Committee—which last met in October 2018—is responsible for providing general oversight and guidance to business units working on IDT-related efforts. However, our review of several sets of Committee meeting minutes indicates that while RICS has briefed committee members on the status of various business IDT efforts, they have not specifically discussed business IDT program priorities, potential fraud risks, or resources. When asked why IRS has not designated an entity to be responsible for overseeing business IDT fraud risk efforts, IRS officials said its business IDT efforts may not require additional oversight because they are significantly smaller than IRS’s individual IDT efforts in terms of both case volume and number of employees. They also said that the business IDT efforts are relatively new. However, with no more than 30 IRS employees working on business IDT issues, each business unit is mainly focused on day-to-day operations. The absence of an entity to lead business IDT fraud risk efforts may contribute to the issues we identify later in this report related to identifying and assessing business IDT fraud risks consistent with leading practices and delays in resolving business IDT cases. The Fraud Risk Framework’s leading practices provide flexibility in structuring the designated entity to best support an agency’s fraud risk management efforts. For example, leading practices note that the designated entity could be an individual or a team, and can vary depending on factors like existing organizational structures and expertise within the agency. In addition, employees across an agency or program, as well as external entities, can be responsible for the actual implementation of fraud controls. For example, IRS could designate one business unit as a lead entity, or leverage existing cooperative relationships between RICS, AM, CI, and RAAS to establish a business IDT leadership team with defined responsibilities and authority for managing fraud risk. A lead entity could help provide a strategic direction, coordination across business units, and oversight for managing IRS’s business IDT fraud risks. Further, without a designated entity, it is not clear which entity would be responsible for assessing business IDT risks and documenting the results, consistent with leading practices. These activities are important to combat the evolving threat of business IDT. IRS Has Not Developed a Business IDT Fraud Risk Profile IRS Has Not Developed a Fraud Risk Profile Based on Assessed Business IDT Risks The Fraud Risk Framework calls for agencies to regularly plan and perform fraud risk assessments to determine a risk profile. Fraud risk assessments that align with the Fraud Risk Framework involve (1) identifying inherent fraud risks affecting the program, (2) assessing the likelihood and impact of those fraud risks, (3) determining fraud risk tolerance, (4) examining the suitability of existing fraud controls and prioritizing residual fraud risks, and (5) documenting the results (see fig. 3). Such a risk assessment provides the detailed information and insights needed to create a fraud risk profile, which, in turn, is the basis for creating an antifraud strategy for the program. IRS has taken preliminary steps to understand fraud risks associated with business IDT through data analysis efforts and internal discussions with subject matter experts. However, IRS has not fully identified and assessed fraud risks to business IDT consistent with leading practices. These practices include identifying and assessing the likelihood of inherent fraud risks, determining a fraud risk tolerance, and examining the suitability of existing fraud controls to determine if they appropriately address identified risks. IRS business units use current and prior year tax return data and information on known business IDT threats to improve existing fraud detection efforts and develop new efforts. For example, RICS and RAAS officials stated that they regularly collaborate to discuss the feasibility of new fraud filters and identify and prioritize analyses on business IDT data. This effort has resulted in IRS business units identifying 38 discrete projects to, for example, analyze existing fraud filter performance and understand business tax return filing behaviors. RICS officials stated they typically identify two to three projects to begin each year, resources permitting. In addition, IRS officials stated that at the end of each filing season, they review and analyze confirmed business IDT cases to identify any new patterns or trends that may be useful for enhancing existing fraud filters and developing fraud detection models in RRP. Further, RAAS has performed ad hoc data analyses, such as on the characteristics of fabricated entities, to help understand potential risks to the business tax environment. While these are positive steps, IRS has not assessed business IDT fraud risks consistent with leading practices in the Fraud Risk Framework. For example, IRS has not identified and documented inherent fraud risks in the business tax environment, or assessed the likelihood of their occurrence and impact on IRS—the first two steps of a fraud risk assessment process. Further, our review of past GAO, Treasury Inspector General for Tax Administration (TIGTA), and National Taxpayer Advocate reports identified issues that pose inherent risks to IRS’s business IDT efforts. These risks include weaknesses with correspondence-based authentication, EIN vulnerabilities, and the high false detection rates for IDT fraud filters. We consider these to be inherent risks due to the complex nature of the business tax environment and IRS management’s overall limited response to them. Weaknesses with correspondence-based authentication. To help verify whether a suspicious business tax return is legitimate, IRS’s business IDT procedures rely on correspondence-based authentication. This involves the taxpayer answering several brief, written questions about the business and sending this information to IRS via mail. IRS officials stated that they believe correspondence-based authentication is no less secure than other forms of authentication, such as having business owners verify their identity in-person at a Taxpayer Assistance Center or authenticating via telephone. However, unlike other forms of authentication, correspondence-based authentication is inherently less secure because it may not require the taxpayer to verify their identity using a government-issued form of identification. Consequently, IRS has less assurance that the person is the actual business owner and the return in question is legitimate. In June 2018, we reported that IRS had not performed risk assessments to identify, assess, and mitigate risks associated with correspondence- based authentication because it did not have a policy that requires regular assessments and timely mitigation of identified issues. Therefore, without a policy for conducting risk assessments for correspondence- based authentication and a plan for performing an assessment, IRS may underestimate known risks and overlook emerging threats to the tax environment. We recommended that IRS establish a policy for conducting such risk assessments and develop a plan for performing them. IRS agreed with our recommendations and, as of November 2019, had developed a draft policy for conducting risk assessments. However, IRS had not yet developed a plan for performing these assessments. IRS officials stated that they intend to address these recommendations by May 2020. EIN vulnerabilities. In February 2018, TIGTA identified concerns with IRS’s EIN application process and made 18 recommendations, including that IRS improve processes to ensure that the applicant meets the requirements for obtaining an EIN and implement policies to help detect potential abuse of the online EIN application system. IRS agreed with 15 of TIGTA’s recommendations and, as of September 2019, IRS reported that it had addressed 11 recommendations. The four unaddressed recommendations aim to improve data collection and validation in the EIN system, which could help IRS identify suspicious applications. IRS officials stated that these improvements are on hold due to limited resources and competing priorities. In addition, characteristics of the EIN may make it inherently risky and susceptible to fraudsters. According to IRS, a business’s EIN is not considered PII and is not required to be protected like a Social Security number. This may make it easier for a fraudster to obtain an existing EIN and file a fraudulent business tax return. In addition, we have previously reported that fraudsters may target paid preparers, tax software providers, and other third parties to steal taxpayer data to commit IDT refund fraud or other types of financial crimes. These data may include existing EINs or the necessary information to obtain a new EIN, making it easier for fraudsters to file fake business returns. IRS officials stated that they recognize the potential risk of the EIN application process, but must balance the needs of legitimate businesses against IRS’s responsibility to detect and prevent fraud. Officials noted that they have security measures in place to detect potentially suspicious activity in the online EIN application and fraud filters to detect when taxpayers file a return with a dormant EIN. A fraud risk assessment consistent with leading practices would help IRS establish a risk tolerance for the EIN process and determine if its existing fraud controls are sufficient to address the vulnerabilities inherent to the EIN application process. High false detection rates for IDT fraud filters. The National Taxpayer Advocate’s 2018 Annual Report to Congress noted that one of IRS’s most serious problems is a high false detection rate in its fraud detection systems. In general, the false detection rate is the number of legitimate returns selected by the IRS as potentially fraudulent, divided by the total number of returns selected as potentially fraudulent. The National Taxpayer Advocate noted that IRS’s false positive rate for individual IDT filters was 63 percent in 2018. The high rate contributed to increased processing times and delays in issuing refunds for legitimate returns. It also created additional work for IRS. Similarly, our data analysis of BMFIC data shows that IRS’s business IDT fraud filters had about an 85 percent false detection rate for returns screened by fraud filters from mid- January 2017 to December 2018. In September 2019, IRS officials described several factors contributing to the high false detection rate for business IDT fraud filters. These factors include taxpayers and tax preparers failing to update key information with IRS, cross-referenced fraud filters triggering other filters, and changes in taxpayer filing behaviors due to new tax laws. The officials said they are working to reduce the false detection rate. While it is reasonable to expect fraud filters will catch some legitimate returns, IRS has not conducted a risk assessment—or developed a fraud risk tolerance—consistent with leading practices. Determining a fraud risk tolerance would help officials determine how best to balance the risks of missing fraudulent returns with the risks of flagging legitimate returns. Doing so may also help IRS prioritize any needed improvements to existing filters. According to the Fraud Risk Framework, a fraud risk assessment is the basis for developing an antifraud strategy. Among other things, an antifraud strategy considers the benefits and costs of control activities to address risks, such as the inherent business IDT risks described above, and other risks facing the program. As of July 2019, IRS’s Wage and Investment division had identified the overall threat of business IDT as one of 12 risks it is currently facing. However, IRS’s risk documentation does not include important components of a fraud risk assessment consistent with GAO’s Fraud Risk Framework. Specifically, the documentation does not include information on the likelihood or impact of each risk, IRS’s risk tolerance, or clear plans or responsibilities for mitigating risks. A business IDT fraud risk assessment with these key items would position IRS to develop a fraud risk profile and an antifraud strategy for business IDT going forward. In addition, officials from IRS’s Office of the Chief Risk Officer stated that consistent with the Fraud Reduction and Data Analytics Act of 2015 (FRDAA), the agency compiles an annual enterprise-wide fraud risk report based on program-level risks that IRS business units identify and monitor. The Office of the Chief Risk Officer’s October 2019 report acknowledges business IDT as one of 11 enterprise fraud risks for 2019– 2020. A fraud risk assessment and a fraud risk profile on business IDT consistent with leading practices would also help support IRS’s broader efforts to report and monitor enterprise-wide fraud risks. IRS officials stated that they have not performed a formal fraud risk assessment or developed a fraud risk profile for business IDT because they have directed their resources toward identifying and addressing fraud that is occurring right now and improving fraud detection efforts. When asked whether they had plans to further identify and assess inherent fraud risks for business IDT—the first step of the fraud risk assessment process—IRS officials said they thought that the costs of identifying and assessing inherent risks of business IDT would likely outweigh the benefits given the relatively low volume of confirmed business IDT cases, compared with individual IDT refund fraud. Without assessing inherent risks, determining the likelihood, impact, and IRS’s tolerance for each risk, and examining the suitability of existing fraud controls, IRS lacks reasonable assurance that it is aware of the most significant fraud risks facing business IDT. Such an analysis would also help IRS determine whether additional fraud controls are needed and whether to make adjustments to existing controls. Further, without this critical information, IRS will be unable to develop a fraud risk profile consistent with leading practices. A fraud risk profile for business IDT may help IRS make better informed decisions about allocating resources to combat business IDT and minimize financial losses. Consistent with our Fraud Risk Framework, a fraud risk profile that considers the likelihood and impact of fraud risks, IRS’s tolerance for risk, and the suitability of existing fraud detection activities is critical for developing an antifraud strategy and ensuring that IRS has an effective approach to addressing risks to business IDT. Collecting Additional Data Could Help IRS Estimate the Size and Scope of Business IDT The Fraud Risk Framework states that managers may conduct quantitative or qualitative assessments, or both, to help determine the likelihood and impact of inherent fraud risks on the program’s objectives and help estimate fraud losses and frequency. Further, federal internal control standards call for program managers to use quality information to achieve their objectives, address relevant risks, and communicate that information as necessary to internal and external stakeholders. As of September 2019, IRS was collecting fraud filter data for some, but not all, business-related forms that may be susceptible to business IDT. Our analysis of IRS’s data shows that for 2018, business IDT fraud filters covered about 88 percent of business tax forms claiming a refund (14.0 million out of 15.9 million returns) and nearly all employment tax forms claiming a refund (30.7 million out of 31.0 million returns). IRS officials stated that since 2016, they have incrementally implemented business IDT fraud filters for the most commonly filed forms. We recognize that IRS has made progress in implementing filters for commonly filed forms and that the deceptive nature of fraud makes developing accurate fraud estimates challenging. However, our analysis shows that IRS has not developed business IDT fraud filters for at least 25 additional business-related tax forms. In 2018, these forms represented about $10.4 billion in refunds. As a result, IRS is not able to analyze data from these forms for emerging fraud patterns or schemes. Further, while current business IDT fraud filters cover the most commonly filed forms, IRS has not assessed which remaining forms or fraud scenarios pose the greatest risk to IRS and taxpayers. IRS also has not determined a risk tolerance for existing fraud filters, and whether the benefits of expanding existing filters outweigh the risks of flagging legitimate returns. Given the complexity of business tax forms and the evolving nature of fraud schemes, IRS’s existing fraud filters may not be sufficient to detect different business IDT scenarios. For example, IRS has implemented two fraud filters related to business tax credits, but they are each limited to a specific scenario. TIGTA has previously reported that tax credit forms have been found to be attractive to fraudsters. For example, in 2015, TIGTA reported that fraudsters have targeted individual tax credits when filing a fraudulent tax return to increase their refund. In September 2019, TIGTA reported that IRS lacked systematic controls to identify or prevent fraudulent use of an electric motor vehicle tax credit which is available to individuals and businesses. Without additional data on business IDT, IRS cannot estimate the full size and scope of this problem. As we have previously reported, IRS’s annual Identity Theft Taxonomy (Taxonomy) is a valuable tool to inventory, characterize, and analyze available individual IDT refund fraud data and to assess the performance of IRS’s individual IDT refund fraud defenses. Following each filing season, IRS estimates the volume of returns and associated dollar amounts on attempted and prevented individual IDT refund fraud, and on refunds it paid to fraudsters. While we recognize there may be differences in how IRS estimates the extent of individual versus business IDT, the Taxonomy is a useful framework to understand the data IRS needs to estimate the size and scope of business IDT. For example, the Taxonomy estimates the number of identified individual IDT refund fraud cases where IRS prevented or recovered the fraudulent refunds (e.g., returns caught by fraud filters or suspicious refunds returned by banks). In December 2018, IRS developed a draft plan for an initial business IDT taxonomy based on two business tax forms on which IRS has collected data since 2016. IRS officials stated that they intend to begin preliminary work on this effort in December 2019. However, these efforts will be limited until IRS collects additional data. IRS officials stated that they are committed to better understanding business IDT and expanding their fraud detection and data collection efforts. However, officials said that doing so depends on the availability of resources to develop and test new fraud filters prior to each filing season. IRS may address these constraints by, for example, determining which forms or fraud scenarios pose the greatest risk for business IDT based on a fraud risk assessment and profile. This would include determining a risk tolerance for business IDT on these forms and prioritizing new filters or filter enhancements based on its risk assessment. Having additional data to better estimate the size and scope of business IDT is critical in helping IRS understand how fraudsters are evading IRS defenses. Additionally, such data will help IRS identify unknown business IDT fraud risks, allocate limited resources, assess the suitability of its existing fraud control activities, and develop tools such as a business IDT taxonomy. Further information on the size and scope of business IDT could better position IRS to assess the risk of business IDT on tax administration and inform the Congress and the public about the risk. IRS Has Procedures for Resolving Business IDT Cases, but Has Not Established Customer Service-Oriented Performance Goals IRS has established procedures for resolving business IDT cases in its Internal Revenue Manual (IRM) and officials described general guidelines for resolving both pre-refund and post-refund business IDT cases. However, IRS does not resolve all cases within these guidelines due to various challenges IRS could potentially address, such as correspondence-based authentication; and challenges which are more difficult to address, such as the overall complexity of business IDT cases. In addition, we found that a lack of customer service-oriented performance goals for resolving cases may also contribute to delays. Key IRS documents highlight both a commitment to combating IDT refund fraud and improving customer service for taxpayers by, for example, reducing case resolution time frames through new technologies, among other things. In addition, Office of Management and Budget guidance highlights that federal program and project managers have an obligation to ensure that their programs deliver efficient and effective services to the public. This includes assessing how well a program is working to achieve intended results, and delivering customer service to align with the program’s goals. Our review of IRS documentation found that business units have developed procedures to manage and resolve business IDT cases identified during different stages of the tax return process. For example, during the pre-refund stage, RICS notifies business taxpayers via mail if their return shows signs of potential IDT refund fraud and has been held for review. Similarly, when a taxpayer notifies IRS about potential IDT refund fraud during the post-refund stage, Accounts Management (AM) may require the taxpayer to submit a form describing how and when the fraud occurred. IRS business units have also established procedures for conducting in-depth research on taxpayer accounts to determine if a case is business IDT or another type of fraud. However, RICS and AM have had some difficulty in resolving cases within their respective guidelines, as described below. Pre-refund cases. In regards to pre-refund business IDT, cases are generally to be resolved within 90 days, according to IRS’s IRM and agency officials. RICS officials stated that they aim to meet this guideline because it provides enough time to reach the correct taxpayer via mail and for the taxpayer to respond. However, RICS has been challenged in resolving cases within 90 days. Our analysis of pre-refund business IDT cases opened from mid-January 2017 through December 2018 shows that RICS did not meet this guideline for about 87 percent of cases, including open cases. RICS also took between 6 months to 2 years to resolve about 29 percent of cases (see fig. 4). Further, our analysis found that this delay was consistent across case outcomes. On average, RICS took 136 days to resolve cases of confirmed business IDT (7,248 cases) and 171 days to resolve cases determined not to be business IDT (58,279 cases). As of August 2019, IRS had not resolved 4,649 cases which had been open for an average of 383 days. RICS officials identified several reasons for the delay in resolving pre- refund cases, including ones rooted in business IDT policies and procedures. Specifically, officials stated that communicating with the taxpayer via correspondence is the primary driver of delays in resolving cases. RICS officials stated that mail-based authentication generally takes more time because letters can get lost, thrown away, or not reach the right person. RICS officials stated that in March 2018, they began making two attempts to correspond with a business with a potentially suspicious return before closing a case, rather than one attempt. RICS made this change because taxpayers were taking longer than 45 days to respond to the letter, often after RICS had closed the case as a nonresponse. Officials stated that while they are aware of IRS’s other methods of authenticating taxpayers for individual IDT refund fraud, such as by phone or in person, they have not explored similar options for the business IDT program. As we reported in June 2018, IRS uses a risk-based approach to determine the ways in which a taxpayer can authenticate his or her identity and what data are required during the authentication process. High risk interactions include those when a taxpayer accesses prior year tax information and other PII, while lower risk interactions include a taxpayer paying a bill online. According to IRS officials, as the risk level of taxpayer interactions increases, the authentication process becomes more rigorous. This approach minimizes risk to both the taxpayer and IRS. In addition, officials identified other challenges that contribute to delays, including incorrect information on the business taxpayer’s account, nonresponses to authentication requests, and the complexity of business IDT cases, which may be more difficult to address. RICS officials noted that taxpayers do not always update the business’s responsible party with IRS when they sell or transfer a business to someone else. This can make it more difficult for IRS to contact the taxpayer when their return has been selected for review. RICS officials stated that IRS reminds business taxpayers to check and update their information each year to avoid unnecessary delays in processing tax returns; however, IRS does not require taxpayers to make updates. IRS officials also stated that a business’s failure to respond to mail-based authentication requests contributes to case resolution delays. Finally, RICS officials noted that the inherent complexity of the business IDT environment may require RICS staff to research cases across multiple IRS business units or refer cases outside of RICS, which can contribute to delays. Post-refund cases. Our review of AM procedures and discussions with officials indicate that post-refund business IDT cases are generally to be resolved within 6 months. AM officials stated they established this guideline for individual IDT refund fraud cases and extended it to business IDT cases when the program started in 2016. We analyzed post-refund cases that AM opened from July 2016 (when IRS began collecting data) through December 2018. We found that AM resolved about 84 percent of post-refund cases within 6 months. However, about 17 percent of these cases—including open cases—took more than 6 months to resolve (see fig. 5). Similar to RICS officials, AM officials cited several reasons for case resolution delays, including the complexity of the business tax environment and the need to research associated businesses, employment, and individual tax returns. AM officials also noted challenges inherent to the case research process, including that staff often pursue multiple lines of inquiry to determine a case outcome. This may involve referring cases to other business units if, for example, AM staff do not have access to a specific IRS system to complete their research. Finally, AM officials stated that AM staff do not always recognize business IDT cases and may initially classify them as an individual IDT case, which results in delays. To help address this issue, AM officials stated that management periodically reviews business IDT operations, and provides refresher training in areas where staff did not follow procedures consistently. While RICS and AM officials have stated that they have general guidelines for resolving business IDT cases, they have not established customer service-oriented performance goals. We have previously found that a fundamental element in an organization’s efforts to manage for results is its ability to set meaningful goals for performance, including customer service standards, and to measure progress toward those goals. Standards that include customer service-oriented performance targets or goals allow agencies to define, among other things, the level, quality, and timeliness of the service they provide to their customers. In the context of IRS’s business IDT efforts, a customer service-oriented goal could be, for example, to resolve a certain percentage of cases within a specific timeframe. This is particularly important for IRS because one of its strategic goals is to empower customers to meet their tax obligations by providing exceptional customer service. Identifying and implementing methods to address challenges that IRS can control—such as reliance on correspondence-based authentication— could help IRS improve its timeliness in resolving business IDT cases and address its overall strategic objective to reduce case resolution time frames. It is also consistent with OMB guidance to deliver efficient and effective services to the public. Further, establishing customer service- oriented performance goals could help IRS measure progress, identify opportunities for improvement, and communicate reasonable time frames for resolving cases to taxpayers. Case resolution performance goals may also help reduce costs to the Treasury. Specifically, IRS has a legal obligation to pay interest on refunds issued after 45 days from the due date of the tax return. This requirement includes incoming tax returns that IRS holds for review for potential business IDT but then later releases for processing. Specific and relevant performance goals for both pre-refund and post-refund cases may help IRS balance its efforts to protect revenue against the burden on legitimate taxpayers and additional costs to the Treasury. Conclusions IRS has recognized business IDT as a growing threat to both taxpayers and tax administration. The complexity of the business tax environment— including different business types and taxes that businesses must pay— makes detecting, researching, and resolving potential business IDT cases more challenging for IRS compared with individual IDT cases. IRS has taken important steps to prevent business IDT, including using fraud filters to screen incoming business returns on selected forms and collaborating with state and industry partners to identify and respond to potentially suspicious activity. IRS leadership has demonstrated an overall commitment to identifying and combating IDT refund fraud. However, IRS has not designated a lead entity to design and oversee business IDT fraud risk management activities consistent with leading practices. A lead entity could also help IRS ensure its business IDT activities are better coordinated to combat the evolving threat of business IDT. Further, while IRS has taken some steps to understand business IDT fraud risks, it has not developed a fraud risk profile based on an assessment of inherent risks, the likelihood and impact of risks, IRS’s risk tolerance, and an evaluation of existing fraud controls. Assessing inherent fraud risks, such as those that we highlighted—correspondence-based authentication, vulnerability of EINs, and a high false detection rate for IDT fraud filters—would help IRS to establish a fraud risk tolerance and form the basis for an antifraud strategy. IRS has made progress in detecting and preventing business IDT by implementing fraud filters and collecting data on six business-related tax forms. However, without a risk profile, IRS does not have assurance that its existing filters mitigate inherent risks. For example, risks may also be associated with at least 25 other tax forms, and IRS has not determined which forms or fraud scenarios pose the greatest risk to IRS and taxpayers based on an analysis of risk. Collecting additional data by implementing new fraud filters would better position IRS to estimate the full size and scope of business IDT. IRS’s planning documents articulate a commitment to reducing case resolution time frames and improving customer service, but RICS and AM have been delayed in resolving business IDT cases due to various challenges. Identifying and implementing ways to address the challenges IRS can control, such as its methods for taxpayer authentication, and establishing customer service-oriented case resolution performance goals could help IRS better serve taxpayers and minimize additional costs to the Treasury. Recommendations for Executive Action We are making the following six recommendations to IRS: The Commissioner of Internal Revenue should designate a dedicated entity to provide oversight of agency-wide efforts to detect, prevent, and resolve business IDT, consistent with leading practices. This may involve designating one business unit as a lead entity or leveraging cooperative relationships between business units to establish a business IDT leadership team. This entity should have defined responsibilities and authority for managing fraud risk. (Recommendation 1) The Commissioner of Internal Revenue should develop a fraud risk profile for business IDT that aligns with leading practices. This should include (1) identifying inherent fraud risks of business IDT, (2) assessing the likelihood and impact of inherent fraud risks, (3) determining fraud risk tolerance, and (4) examining the suitability of existing fraud controls. (Recommendation 2) The Commissioner of Internal Revenue should develop, document, and implement a strategy for addressing fraud risks that will be identified in its fraud risk profile. (Recommendation 3) The Commissioner of Internal Revenue should ensure that IRS collects additional data on business IDT by identifying and implementing new fraud filters consistent with its fraud risk profile. This should include prioritizing IDT filters for tax forms determined to be most at risk based on an analysis of risk tolerances. (Recommendation 4) The Commissioner of Internal Revenue should identify and implement methods to address delays in resolving business IDT cases due to correspondence-based authentication. This could involve using different methods for taxpayer authentication based on the risk level of the return. (Recommendation 5) The Commissioner of Internal Revenue should establish customer service-oriented performance goals for resolving business IDT cases. (Recommendation 6) Agency Comments and Our Evaluation We provided a draft of this report to IRS for review and comment. In written comments, which are summarized below and reproduced in appendix II, IRS’s Deputy Commissioner for Services and Enforcement agreed with five of our six recommendations and neither agreed nor disagreed with one of our recommendations. IRS agreed with our four recommendations to better identify, assess, and manage business IDT fraud risks consistent with leading practices in our Fraud Risk Framework. IRS agreed to designate a dedicated entity to provide oversight of agency-wide business IDT efforts and stated that it will determine the appropriate oversight structure and scope of authority. IRS also agreed with our recommendations to, consistent with leading practices, develop a business IDT fraud risk profile; develop, document, and implement a strategy for addressing fraud risks; and implement and prioritize new fraud filters consistent with its fraud risk profile. IRS did not provide details on the actions it plans to take to address these recommendations. In its written comments, IRS stated that formally implementing leading practices in the Fraud Risk Framework may be helpful, but noted that it has consistently completed business IDT fraud risk assessments and developed risk profiles. However, during our review, IRS did not provide evidence that it had taken such actions. Figure 3 in our report outlines leading practices for performing a fraud risk assessment and developing a risk profile. For example, regarding the leading practice to identify and assess inherent fraud risks, IRS stated that it has found that the risks associated with in-person or telephone authentication are higher for business IDT than correspondence-based authentication. However, we could not verify this assertion, as IRS did not provide evidence during our audit that it had assessed the risks of different authentication options for business taxpayers. Further, IRS stated that our report does not acknowledge that multiple individuals may be authorized to act on behalf of a business, including authenticating a potentially suspicious tax return. We have added this information to our report. IRS also stated that our report implies that it would be acceptable for a percentage of potentially fraudulent returns to be filed, unchecked, solely to reduce false detections or business costs. However, as we indicate in our report, fraud risk tolerance does not mean IRS management tolerates fraud, or that it needs to eliminate controls to detect and prevent fraud. Rather, it means that IRS management accepts a certain amount of risk, based on its assessment of the likelihood and impact of the fraud. Determining a fraud risk tolerance would help IRS management establish appropriate and cost-effective controls that are commensurate with the fraud risk. Relatedly, we agree with IRS’s statement that IDT victims suffer significant financial, social, and emotional hardships. We have updated the report’s introduction to acknowledge these hardships. In addition, IRS stated that its work on business IDT filters is more robust than stated in our report. Our report recognizes various IRS efforts to improve business IDT fraud detection and prevention, including efforts to refine its fraud filters. However, having fraud filters does not preclude IRS from identifying and assessing other potential fraud risks. Further, IRS cannot accurately determine the suitability of its business IDT filters—or other controls—without first identifying inherent fraud risks, assessing the likelihood and impact of those risks, and determining a fraud risk tolerance. Additionally, IRS did not provide evidence that it has examined the suitability of other antifraud controls, including controls to prevent fraudsters from obtaining new EINs using stolen information. IRS neither agreed nor disagreed with our recommendation to establish customer service-oriented performance goals for resolving business IDT cases. However, IRS stated that it will review its customer service- oriented performance goals and modify them, as warranted, to address the resolution of business IDT cases. Doing so would meet the intent of our recommendation. In its written comments, IRS stated that our report does not fully address obstacles that prevent timely case resolution. We have revised our discussion of pre-refund cases to more clearly identify nonresponses from taxpayers as a cause for delays. IRS also said our methodology for determining the time to close business IDT cases does not adequately consider the impact of nonresponses on the agency’s ability to close cases in a timely manner. We have added a note to figure 4 to acknowledge the challenge of nonresponses. However, IRS did not provide evidence during the audit that it collects data on how long a case is suspended while it waits for the taxpayer to respond—information that would provide insight into the challenges associated with resolving business IDT cases in a timely manner. As agreed with your offices, we plan no further distribution of this report until 30 days from the report date. At that time, we will send copies to the Chairmen and Ranking Members of other Senate and House committees and subcommittees that have appropriation, authorization, and oversight responsibilities for IRS. We will also send copies of the report to the Commissioner of Internal Revenue and other interested parties. In addition, this report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff has any questions about this report, please contact me at (202) 512-9110 or mctiguej@gao.gov. Contact points for our offices of Congressional Relations and Public Affairs are on the last page of this report. GAO staff members who made major contributions to this report are listed in appendix III. Appendix I: Objectives, Scope, and Methodology Our objectives were to (1) describe the Internal Revenue Service’s (IRS) efforts to detect business identity theft refund fraud (business IDT), (2) evaluate the extent to which IRS’s efforts to prevent business IDT are consistent with selected fraud risk management leading practices, and (3) assess IRS’s efforts to resolve business IDT cases. In this report, business IDT refers to the fraudulent use of both business and employment tax forms. Both of these types of forms require an Employer Identification Number (EIN) when filing with IRS, and a fraudster can file these forms to obtain a refund. To address all of our objectives, we reviewed our prior reports on individual identity theft refund fraud and the Treasury Inspector General for Tax Administration’s (TIGTA) prior reports on business IDT. We also interviewed IRS officials from business units responsible for detecting, preventing, and resolving business IDT cases, specifically from Return Integrity and Compliance Services (RICS), Accounts Management (AM), and Criminal Investigation (CI). In December 2018, we visited IRS’s campus in Ogden, Utah, to interview officials responsible for IRS’s business IDT efforts and to observe how RICS and AM staff process and research business IDT cases using IRS information technology systems and tools. To describe IRS’s current processes to detect business IDT refund fraud, we reviewed documentation describing the business IDT fraud filters IRS implemented from 2017 through 2019, including the logic for each filter and the forms to which they apply. In addition, we analyzed data from IRS’s Dependent Database (DDb) on business IDT fraud filter results for applicable incoming business and employment tax returns IRS received from mid-January 2017 through mid-August 2019. This was the most recent, complete, and available set of data at the time of our review. This analysis showed the volume of returns selected by IRS’s business IDT fraud filters by form, tax processing year, and associated refund amount. We also analyzed data from IRS’s Business Master File Identity Check (BMFIC) system—RICS’s case management system for business IDT returns flagged by DDb—for cases opened from mid-January 2017 through mid-August 2019. These were the most complete set of data available at the time of our review. Our analysis of BMFIC data showed the number of returns that RICS researched as potential business IDT, the outcome of the case, and associated refund amounts. For the purpose of analysis and reporting, we grouped business IDT case outcomes into three categories: confirmed business IDT, not business IDT, and open/unresolved. We assessed the reliability of data from these systems by: (1) testing key data elements, including checks for missing, out-of-range, or logically inaccurate data; (2) reviewing documents for information about the data and IRS’s systems; and (3) interviewing officials knowledgeable about the data to discuss any limitations. We determined that these data were sufficiently reliable to describe the volume of incoming returns stopped by business IDT fraud filters, associated refunds, and the outcome of business IDT cases. To understand IRS’s efforts to collaborate with external partners to detect and prevent business IDT, we interviewed IRS and state officials from the Security Summit’s Business IDT sub-workgroup and reviewed IRS’s 2018 report which analyzed business-related data elements from incoming tax returns. We also interviewed IRS officials about a pilot program with the Alabama Department of Labor to help detect and deactivate potentially suspicious EINs established in that state. For context, we obtained information from January to December 2018 from IRS on the performance of this pilot, including the number of EINs identified as fraudulent. To evaluate the extent to which IRS’s efforts to prevent business IDT are consistent with selected fraud risk management leading practices, we reviewed the Fraud Reduction and Data Analytics Act (FRDAA) of 2015 and leading practices outlined in A Framework for Managing Fraud Risks in Federal Programs (Fraud Risk Framework). We generally focused our review on the first two components of the Fraud Risk Framework: (1) commit to combating fraud by creating an organizational culture and structure conducive to fraud risk management, and (2) plan regular fraud risk assessments and assess risks to determine a fraud risk profile. We reviewed agency documents and information obtained from interviews, as described below, and compared them against leading practices identified in the Fraud Risk Framework related to these two components. We reviewed IRS’s most recent strategic planning documents related to reducing fraud, IRS organizational charts, and relevant Internal Revenue Manual (IRM) sections on business IDT operations and procedures. We interviewed officials from RICS, AM, CI, and the Office of Research, Applied Analytics, and Statistics (RAAS) to understand each business unit’s respective role in detecting, preventing, and resolving business IDT cases and the extent to which business units work together on day-to-day and longer-term efforts. In addition, we reviewed IRS reports on business IDT case workload. We also reviewed meeting notes from IRS’s IDT Executive Steering Committee (July and October 2017, and January and October 2018) to understand the extent to which IRS’s executive-level groups are, for example, involved in helping guide business IDT efforts or made aware of business IDT challenges. We interviewed officials from RICS, AM, CI, and RAAS and reviewed documentation on IRS’s efforts to identify and assess business IDT fraud risks. These included reviewing RAAS’s analyses on business IDT fraud filter performance, descriptions of potential new fraud filters that IRS may implement in the future, and the Wage and Investment Division’s risk register. We also interviewed officials from IRS’s Office of the Chief Risk Officer to understand IRS’s efforts to compile and report on enterprise-wide fraud risks and agency efforts to develop an antifraud culture. Further, we reviewed documentation related to three inherent fraud risks to business IDT that we identified in the course of our work: correspondence-based authentication, EIN vulnerabilities, and high false-detection rates for IDT fraud filters. This included reviewing prior GAO, TIGTA, and National Taxpayer Advocate reports and the status of open recommendations, and relevant IRM sections. We reviewed the methodologies of these reports and found them reasonable for the purpose of describing the inherent risks related to business IDT. In addition, we identified a false detection rate for business IDT fraud filters based on BMFIC cases opened from mid-January 2017 through December 2018. To do so, we compared the number of cases IRS determined were not business IDT, relative to the total number of cases. We did not include BMFIC cases from 2019 because at the time of our analysis, about 27 percent of those cases were unresolved. We also assessed the extent to which IRS is positioned to estimate the size and scope of business IDT. To do so, we reviewed documents and information on IRS’s efforts to collect quality data on incoming business and employment returns. We compared these efforts to leading practices associated with the first two components of the Fraud Risk Framework and Standards for Internal Control in the Federal Government related to using quality information. Specifically, we determined what proportion of incoming business and employment tax forms filed in 2018 would have been screened by business IDT fraud filters, by tax form type. We also reviewed a preliminary plan and interviewed RAAS and RICS officials on their efforts to develop a business IDT taxonomy. To assess IRS’s efforts to resolve business IDT cases, we reviewed IRS procedures for managing, researching, and resolving pre-refund and post-refund business IDT cases. We interviewed officials from RICS and AM to understand the rationale behind their respective current case resolution time frames, and potential reasons for case resolution delays. We compared RICS and AM’s efforts to resolve business IDT cases against Office of Management and Budget guidance on program management and providing customer service. To determine RICS’s performance in resolving business IDT cases identified during the pre- refund phase, we analyzed 181,032 cases from BMFIC, described above. Specifically, we calculated the duration between when RICS opened the case in BMFIC to when the case was closed. In addition, we determined how many cases in RICS’s inventory were open at the time of our analysis in August 2019. For these open cases, we manually added the date we received the data as the date the case was closed. This was an indicator of the minimum amount of time RICS could have taken to close these cases. For this analysis, we did not include cases opened and closed in 2019 because we wanted to ensure there was sufficient time for RICS to research and close a case. We determined that cases opened by the end of December 2018 gave both RICS and AM (discussed below) enough time to resolve a case. In addition, we identified an anomaly in RICS’s 2019 cases. IRS officials stated that a new fraud filter inaccurately flagged incoming returns on one form, and IRS released these returns. Our analysis of RICS’s data showed that these returns accounted for about 65 percent of closed cases in 2019, and that they were resolved in an unusually short time frame (fewer than 45 days) thus skewing the overall data. We also did not include 1,679 cases that were opened and closed in zero or fewer days. To determine AM’s performance in resolving business IDT cases identified during the post-refund phase, we analyzed 1,997 relevant business IDT cases from IRS’s Correspondence Imaging System (CIS) that AM opened from July 2016 through December 2018. As discussed earlier, we did not include cases opened and closed in 2019 to allow AM enough time to research and resolve a case. We calculated the duration between when AM opened the case in CIS to when the case was closed. We also determined how many cases in AM’s inventory were open at the time of our analysis. For these open cases, we manually added the date we received the data as the date the case was closed. This was an indicator of the minimum amount of time AM could have taken to close these cases. We assessed the reliability of the CIS data by reviewing relevant documents, testing key data elements, and interviewing knowledgeable IRS officials. We determined that the data from CIS was sufficiently reliable to determine how long it took AM to resolve post- refund business IDT cases during this time period. We conducted this performance audit from July 2018 to January 2020 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Appendix II: Comments from the Internal Revenue Service Appendix III: GAO Contact and Acknowledgments GAO Contact Staff Acknowledgments In addition to the contact named above, Shannon Finnegan (Assistant Director), Heather A. Collins (Analyst-in-Charge), Ann Czapiewski, Michele Fejfar, Robert Gebhart, Tonita Gillich, Bethany Graham, James Andrew Howard, Krista Loose, Jungjin Park, Bryan Sakakeeny, and Rebecca Shea made significant contributions to this report.