The objective of this limited scope review was to evaluate Internal Revenue Service (IRS) controls to ensure that Official Use Only (OUO) material was not available for public use. We reviewed the IRS’ procedures and guidelines for controlling access to OUO material to determine whether they are adequate for preventing unauthorized disclosure to the public. Additionally, we visited the IRS Headquarters (HQ) and Regional Freedom of Information (FOI) reading rooms and researched the IRS public web page to determine if OUO material was available to the public.

We conducted limited testing, via judgmental samples of IRS material available for public use, at the IRS HQ in Washington, DC, and in the Atlanta, Dallas, New York, and Oakland regional offices from March through April 2000. Except for the limited testing, this audit was performed in accordance with Government Auditing Standards.

Major contributors to this report are listed in Appendix I. Appendix II contains the Report Distribution List.

The Freedom of Information Act (FOIA) (1988), 5 U.S.C. § 552 (1994 & Supp. II 1996), provides that each agency, in accordance with published rules, shall make available for public inspection and copying:

• Final opinions in the adjudication of cases.
• Statements of policy and administrative staff manuals.
• Instructions to staff that affect a member of the public.

In addition, the FOIA requires that the IRS make available to the public information which is not prohibited from disclosure by law and regulations, unless its release would significantly impede or nullify IRS actions in carrying out a responsibility or function or would constitute an unwarranted invasion of privacy.

The Internal Revenue Manual (IRM) includes materials that are subject to the FOIA definition of "administrative staff manuals and instructions to the staff" and should be made available to the public. The IRM also includes information that is considered to be for "Official Use Only" and is not to be made available to the public. OUO material can either be issued within the body of the IRM or as a separate Law Enforcement Manual (LEM). When OUO text appears in the body of an IRM, it must be marked with a "#" sign to designate that it is OUO and not made available to the public. Only IRM Parts 3, 12, and 21 are designated to include OUO text within the body of the IRM. All other OUO text is published in a LEM. The LEM is part of the IRS’ internal management document system that complements the IRM and is not subject to the FOIA definition. Therefore, LEM material is not available to the public.

Treasury regulations require that the IRS HQ and Regional Offices provide a public reading room or reading area where FOIA information is available to the public for inspection and copying. The Office of Freedom of Information is responsible for serving as the IRS FOIA administrator and operating the IRS reading rooms. The IRS Electronic Information Services Branch in the Multimedia Production Division also maintains an electronic FOI reading room on the IRS’ public internet site, the Digital Daily. This site provides access to the IRM and other FOIA information.

We reviewed the IRS’ procedures and guidelines for controlling access to OUO material, searched the IRS public web page, and visited the HQ and Regional FOI reading rooms to determine if any OUO material was available to the public. When followed, the IRS’ procedures and guidelines for designating and controlling access to OUO material are sufficient to prevent unauthorized disclosure to the public.

The LEM is not available in electronic form and can be obtained only in printed versions. The Digital Daily web site contains both a graphic and text version of all sections of the IRM except Parts 3 and 21 (Returns Processing and Customer Service, respectively). A redacted version of ADP and IDRS Information (Document 6209) was also accessible through the web page. We were not able to access any OUO material through the internet.

However, OUO material was found in documents that were available for public inspection in two of the five sites we visited. The HQ FOI reading room contained two versions of the IRM, an outdated version and a current version that is in the process of being revised. Our visual inspection of a limited, judgmentally selected portion of the older IRM did not identify any OUO material. However, our inspection did identify sections of the current IRM that contained OUO material. Further, we identified OUO material accessible by the public in the Dallas reading room.

Our visual inspection of a judgmentally selected sample of current IRM sections in the HQ FOI reading room identified 44 pages of IRM material that contained OUO material, such as tolerance levels; grace periods and due dates; data processing indicators, codes, and instructions; and, penalty abatement instructions. We discussed our results with the Acting Director, Office of Freedom of Information, and provided copies of the IRM pages we identified.

In the Dallas reading room, we identified an outdated version (6/19/87) of IRM 5480 - Substitute for Return Program Handbook that contained tolerance levels and other sensitive information. The distribution for this document specifically stated, "excluding FOI reading room and outside IRS." We discussed this issue with the responsible regional official, who immediately corrected the situation by having the document destroyed.

The IRS Disclosure of Official Information Handbook provides guidance for classifying documents. Specifically, any IRS materials that have been printed and distributed may be assumed to be intended for public release if they have not been classified "Official Use Only." Further, for certain documents and memoranda, such as data processing instructions, it is impossible to segregate classified and public portions into separate publications because the content must be presented and followed by employees in a step-by-step fashion. In these instances, each line to be protected will have the symbol "#" shown to the right of the line. All pages must carry the designation, "Any line marked with a ‘#’ is for Official Use Only." It is the originating division’s responsibility to determine what material is to be marked OUO and to inform the Multimedia Production Division to prepare a redacted version for public use.

The OUO designation is used to protect information, such as enforcement tactics and tolerances that could hinder tax administration and the law enforcement process if they were released to the public. The unauthorized disclosure of OUO material could allow taxpayers to alter their filing practices or avoid the payment of taxes. In addition, the release of computer access and data processing codes could jeopardize the IRS’ tax administration security.

IRM guidelines and procedures for controlling access to OUO material were not consistently followed. Each originating division is responsible for ensuring the IRM copies it provides to the FOI reading room are free of sensitive information. The FOI reading room staff should also review the information to ensure it is "clean" prior to placing it on the shelves for public access. However, the HQ FOI reading room staff has been backlogged with filing, and the IRM was not always reviewed before it was placed on the shelves for public inspection. Further, various originating divisions are in the process of updating their IRM sections. These divisions frequently remove the IRM section to be updated and then return the updated section directly to the HQ FOI reading room shelves without review by the HQ FOI reading room staff. The Dallas reading room situation was created due to an oversight by the reading room staff and was immediately corrected when brought to management’s attention.

1. To provide accountability, the Deputy Commissioner Operations should assign one specific function the responsibility for ensuring IRS procedures and guidelines for designating and controlling access to OUO material are consistently followed. All IRM and official documents that are available for public inspection under the provisions of the FOIA should be reviewed by this centralized function prior to public release.
2. The Office of Governmental Liaison and Disclosure should perform a thorough review of all material currently available in FOI reading rooms to ensure that only redacted versions of the IRM and other official documents are available for public use.

Management’s Response: Management’s response was due on July 10, 2000. As of July 27, 2000, management had not responded to the draft report.

Our limited review of material in the IRS FOI reading rooms identified OUO material that was not redacted from documents available for public use. The unauthorized disclosure of OUO material, such as enforcement tactics and tolerances, could significantly impede or nullify IRS actions in carrying out tax administration and law enforcement responsibilities.

Maurice S. Moody, Associate Inspector General for Audit (Headquarters Operations and Exempt Organizations Programs)

John Wright, Director

Thomas Brunetto, Audit Manager

Annamarie Ugoletti, Senior Auditor

Yolanda Betancourt, Auditor

Catherine Cloudt, Auditor

Steve Holmes, Auditor

Richard Louden, Auditor

Rosemarie Maribello, Auditor

Joanola Rose, Auditor

Deputy Commissioner Operations C:DO

Chief Operations Officer OP

Assistant Commissioner (Examination) OP:EX

Assistant Commissioner (Forms and Submission Processing) OP:FS

National Director, Governmental Liaison and Disclosure OP:EX:GLD

National Director, Multimedia Production OP:FS:M

National Taxpayer Advocate C:TA

Office of the Chief Counsel CC

Office of Management Controls CFO:A:M

Director, Office of Freedom of Information OP:EX:GLD:F

Director, Office of Program Evaluation and Risk Analysis M:O

Director for Legislative Affairs CL:LA

Audit Liaison: Assistant Commissioner (Examination) OP:EX