GAO Flags New IRS Security Gaps, 21 Fixes Still Outstanding

The Government Accountability Office (GAO) has found five new deficiencies in the Internal Revenue Service’s (IRS) management over financial reporting, primarily tied to information security and access controls.  

GAO’s Thursday report described three access control deficiencies, including failures to regularly review user permissions across key financial and personnel systems and delays in revoking access for employees placed on administrative leave.  

The agency found that, in some cases, system and network access remained active longer than appropriate, increasing the risk of unauthorized entry. 

In addition, GAO auditors cited a broader security management lapse, noting the IRS did not remediate certain known, actively exploited vulnerabilities in line with its own policies. 

While the IRS has made progress, resolving 14 of 30 previously open GAO recommendations, including several tied to transaction processing and IT systems, the new deficiencies named in GAO’s report leave the IRS with 21 open recommendations. Most of those recommendations are related to information systems.  

Four of the deficiencies found by GAO are “sensitive in nature and related to information systems,” and details were not publicly disclosed by the agency. The fifth deficiency was “not sensitive in nature and related to IRS’s nonproduction costs.” 

Specifically, GAO said the IRS did not properly separate certain “nonproduction costs” – such as benefits for inactive employees – in its draft fiscal year 2025 financial statements, potentially affecting the accuracy of reported program costs. 

“The new and continuing control deficiencies related to information systems and safeguarding assets increase the risk of unauthorized access to and modification of data and programs, disclosure of sensitive data, and disruption of critical operations,” GAO said. 

GAO also said that the IRS agreed with the recommendations to address both sensitive and nonsensitive deficiencies.  

GAO’s report is part of an annual series of audits the agency conducts to review the consolidated financial statements of the U.S. government.