64 percent of IRS IT hardware beyond its useful life, report says

A report from the Treasury Inspector General for Tax Administration examining the information infrastructure of the Internal Revenue Service has found that more than half of the agency’s hardware is beyond its useful lifespan.

The Sept. 11 report looks at the operations of the agency’s Sustaining Infrastructure Program, which is tasked with monitoring the functional duration of its IT systems.

The program is assigned three IRS staff part-time to carry out a process of prioritizing which IT investments should be replaced over time, coordinating across the agency’s associate chief information officers and various business units to identify which systems may be outdated.

The SI program is funded through multiple IRS sources, including IT support funding, user fees and carryover money. Due to a tidal wave of aging hardware within the agency, SI spent an average of 99.7 of its budget across fiscal 2013 to fiscal 2016, averaging $117.9 million a year. The agency estimates the cost to replace its aged IT systems would run $430 million.

“The IRS has a large and increasing amount of aged hardware, some of which is three to four times older than industry standards,” the report said. “In the IRS’s Fiscal Year 2016 President’s Budget (dated Feb. 2, 2015), the IRS described that its current state of information technology ‘infrastructure poses significant risk of failure,’ and that ‘it is unknown when these failures could occur, how severe they will be or whether they will have material impacts on tax administration during the filing season.’”

The SI program assesses IT assets annually, ranking the systems by their applied risk value and recommending which ones should be replaced to the Infrastructure Executive Steering Committee, with the stated goal of no more than 20 to 25 percent of the agency’s current infrastructure be aged technology. Furthermore, the SI program estimates that it takes 18 to 24 months from the start of the procurement process until the technology is installed, making replacing aging IT.

TIGTA officials also analyzed 107 incident tickets reported to the IRS’s Knowledge Incident/ Problem Service Asset Management system for IT failures rated “critical” or “high” in fiscal 2016, finding that 5 percent most likely involved failure of aged hardware.

Investigators also discovered that 11 hardware components racked up a combined 53 incident reports in fiscal 2016. While the aggregate times to resolve the incident tickets are estimated to be 1,951 hours, TIGTA officials believe repairs may have even taken longer, but weren’t recorded due reporting errors made by staff. The estimated costs to replace those components alone is $656,500.

The report also noted the following system failures:

• The IRS’s Contact Recording infrastructure is “extremely aged” and averages an outage a day, affecting customer service calls.
• The agency’s Taxpayer Advocate webpage crashed on Oct. 31, 2016.
• The system the agency deployed to meet the Treasury Department’s 100 percent Personal Identity Verification enablement compliance mandate in 2015 “was not sustainable long-term due to a lack of operational effectiveness.” While there was updated software to fix the problem, it would also require updated hardware. Investigators found that 30 percent of the agency’s hardware had no end-of-software support, leaving the verification systems open to failure or attack. Agency officials said at the time of the report replacement hardware would be installed in August.

TIGTA offered three recommendations:

• That the IRS CIO should coordinate with the chief financial officer to find additional transfers, reprogramming and possible carryover funds earlier in the process that can be applied to replacing aged IT systems.
• Implement systemic controls to provide accurate incident ticket time entries for the Knowledge Incident/Problem Service Asset Management system.
• That the CIO develop “a comprehensive guidance document that details the IRS’s enterprise-wide processes, policies and procedures as well as roles and responsibilities to effectively manage the IRS’s aged information technology hardware.”

The IRS agreed with the recommendations on IT management guidance and incident ticket reports, but disagreed with the funding recommendation. Agency officials said they had requested in the fiscal 2018 budget that surplus funds be dedicated to Operations Support, as well as an additional $100 million for IT operations.

TIGTA noted that while the requests would help IRS efforts, the sheer number of aged IT systems within the agency means additional measures were needed, namely transfers of unused funding in other areas that would expire at the end of the fiscal year.