IRS fell short on requirement to electronically process business transcript requests

The Internal Revenue Service did not meet a requirement under the Taxpayer First Act to create an online system for processing electronic business transcript requests by January 2023, according to a new report.

The report, released Monday by the Treasury Inspector General for Tax Administration, evaluated the IRS's efforts to modernize its Income Verification Express Service program, also known as IVES, and assess its compliance with provisions in the 2019 law. The Taxpayer First Act required the IRS to update its antiquated technology to make it more efficient and secure and provide better customer service, but the IRS's longtime problems with modernizing its systems, some of which date back to the 1960s, have been difficult to overcome. The 2019 law was full of mandates for the IRS, but provided little in the way of extra funding.

Andrew Harrer/Bloomberg

The Inflation Reduction Act, which Congress passed last year, does provide an additional $80 billion in funding over 10 years for the IRS, in part for improving technology and taxpayer service, but the bulk of it is going toward enforcement. 

One area where the IRS was forced to improve its technology years ago was in processing tax transcript requests. A data breach in 2015 in the IRS's Get Transcript app caused tax return information from over 300,000 taxpayers to be stolen by cybercriminals (see story). The IRS needed to shut down the app and relaunched it the following year with improved authentication.

The IVES system that's the subject of the TIGTA report is actually a separate system that's often used in connection with mortgage applications and other types of loans. According to the IRS, it's used by mortgage lenders and others within the financial community to confirm the income of a borrower during processing of a loan application. The IRS provides return transcript, W-2 transcript and 1099 transcript information generally within approximately two to three business days to a third party with the taxpayer's consent. 

The Taxpayer First Act aimed to speed up that process by allowing electronic transcript requests, but the IRS still has not met the goal of providing an online system by January of this year.

Once they're accepted into the IVES program, participants such as banks and financial institutions can submit requests on behalf of clients to get tax transcripts for individuals and businesses, TIGTA noted. To lessen the risk of releasing taxpayers' information to unauthorized parties, the IRS has to authenticate the validity of the tax transcript request forms to ensure taxpayers actually signed the forms. In fiscal year 2022, the IRS processed 8.3 million tax transcript request forms. 

But TIGTA found the IRS did not meet a key requirement of Section 2201 of the Taxpayer First Act, and didn't offer the capability to process business transcript requests by January 2023. 

"Despite the Taxpayer First Act requiring the IRS create a new online system to process transcript requests, IRS management has not yet made a decision to require participants to use the new system," said the report. "Until the modernized IVES system becomes mandatory to use, enhanced controls will be needed for electronically faxed transcript requests to ensure that transcripts are not issued to unauthorized individuals."

On top of that, TIGTA learned that not enough information is being provided to both participants and taxpayers. "For example, participants will receive limited reject information and taxpayers will not be notified of a pending transcript request that requires they log in to their online account to review and authorize the request," said the report. 

TIGTA also found significant processing delays. There's no single point of contact at the IRS who's responsible for resolving outages of a new inventory management system, which contributed to those delays. Instead of processing transcript requests within the IRS's goal of 72 hours (or three days), transcripts could take as much as 502 hours (or over 22 days) to be processed. 

In addition, the IRS is continuing to process transcript requests even when taxpayers have an identity theft marker on their account, despite the 2015 data breach. TIGTA identified 7,619 tax transcripts that the IVES program improperly issued to the participants for 6,012 taxpayers for 2021. That happened because the IRS's internal guidance hasn't ensured its employees are following the guidelines for rejecting these requests. "As a result, there is a risk of unauthorized disclosure of taxpayer information to unscrupulous individuals," said the report. 

TIGTA made 14 recommendations in the report to modernize and improve the IVES program, including alerts issued to IRS management during the review to address concerns such as ensuring the development of business transcript capability for the modernized IVES system. The IRS largely carried out TIGTA's recommendations about the system in an earlier report. In the new report, TIGTA recommended the IRS put in place controls to adequately authenticate all transcript requests received via fax and assign responsibility for addressing and resolving future outages relating to the new inventory management system. 

IRS officials agreed with 11 of TIGTA's 14 recommendations and partially agreed to one recommendation to provide notices to taxpayers whose transcript requests were rejected, but chose not to provide notices to participants, citing an increased risk of fraud. IRS management disagreed with two of TIGTA's recommendations, even though the report's authors believe they could improve the IRS's controls over electronically faxed transcript requests and give taxpayers the chance to identify potential unauthorized access to tax return data. 

In response to the report, Kenneth Corbin, commissioner of the IRS's Wage and Investment Division, noted that the IRS made some improvements in January to the system, adding two new components, the IVES Application Programming Interface and Web-based User Interface. With the IVES API, high-volume program participants will be able to interface with the IVES system using their own software to directly transmit transcript requests. The WebUI will give participants a secure internet-based service where they will be able to submit requests directly to the IVES program online. Both were developed in response to the Taxpayer First Act, and he is predicting direct online access to IVES will be available by mid-2023.

"We are excited to be moving the IVES program into a more fully integrated digital environment," Corbin wrote. "Great strides have been made in the last two years in moving the program from paper-based to electronic processing."