Privacy Impact Assessment - Business Master File (BMF)
BMF Overview
BMF is an IRS Critical Infrastructure asset. All tax data and related information pertaining to individual business income taxpayers are posted to the BMF so that the file reflects a continuously updated and current record of each taxpayer's account. All settlements with taxpayers are effected through computer processing of the BMF account and the data therein is used for accounting records, for issuance of refund checks, bills or notices, answering inquiries, classifying returns for audit, preparing reports and other matters concerned with the processing and enforcement activities of the Internal Revenue Service.
Systems of Record Number
Treasury/IRS 24.046 CADE Business Master File
Treasury/ IRS 34.037 IRS Audit Trail and Security Records System
Data in the System
1. Describe the information (data elements and fields) available in the system in the following categories:
A. Taxpayer: Tax data and related information pertaining to business taxpayers are posted to the Business Master File. Each account has an entity module and one or more tax modules. The entity module contains data which describes the taxpayer as an entity and contains groups of data including Taxpayer Identification Number(s) (TIN), name, address, etc. A tax module contains records of tax liability and accounting information pertaining to the tax for one tax period. Each tax module contains groups of data including assessed tax liability, payments and other credits, balance due amounts, refund checks sent, and other accounting information relating to a specific tax period.
B. Employee - none
C. Audit Trail Information - Master files by definition do not have an audit trail. They are defined as having interfaces to systems that maintain their own audit trails. There is no direct access to BMF data. All access is through batch files. The data viewed by authorized IRS employees is a copy of the BMF data loaded into any of a number of other systems that have a user interface. These systems maintain the authentication and authorization required, including the use of audit trail information.
D. Other - none.
2. Describe/identify which data elements are obtained from files, databases, individuals, or any other sources.
A. IRS
B. Taxpayer
C. Employee
D. Other Federal Agencies (List agency)
E. State and Local Agencies (List agency)
F. Other third party sources (Describe)
The data is reported by the taxpayer on various returns and schedules. After the initial filing of the tax return, any changes or updates (adjustments) to an account, whether initiated by the taxpayer or the IRS, is submitted as a transaction to post to the master file so that the file reflects a continuously updated and current record of each taxpayer’s account.
3. Is each data item required for the business purpose of the system? Explain.
Yes. The name, TIN, and address are required to identify the taxpayer’s account. The income, deductions, credits, etc. reported on the tax return, as well as any payments received, are required to settle the taxpayer’s account, and maintain a record of taxes assessed, abated and collected.
4. How will each data item be verified for accuracy, timeliness, and completeness?
The front-end input systems (Integrated Submission and Remittance Processing (ISRP), e-file, Generalized Mainline Framework (GMF), etc) validate and correct data entries. The BMF process reformats this information for processing and storage. The front-end systems adhere to the established (and published) input and posting cycles to ensure that returns received from the taxpayers are processed, validated and posted to the Business Master File within required time frames.
5. Is there another source for the data? Explain how that source is or is not used.
No.
6. Generally, how will data be retrieved by the user?
BMF data is not directly accessible by users. Data is extracted on a weekly basis for reports and for loading into other IRS systems, which provide read-only access to the data (on a need to know basis).
7. Is the data retrievable by a personal identifier such as name, SSN, or other unique identifier?
Yes, by name and Employer Identification Number (EIN), or other TIN.
Access to the Data
8. Who will have access to the data in the system (Users, Managers, System Administrators, Developers, Others)?
Authorized IRS personnel and contract program developers, as well as IRS organizations developing managerial and statistical reports.
9. How is access to the data by a user determined and by whom?
Data access is granted on a need to know basis. A potential user must submit a request for access form (5081) to their local management for approval consideration. Users are not permitted access without a signed 5081 form from an authorized management official.
10. Do other IRS systems provide, receive, or share data in the system? If YES, list the system(s) and describe which data is shared. If NO, continue to Question 12.
Yes. All settlements with taxpayers are affected through computer processing of the BMF account and the data therein is used for accounting records, for issuance of refund checks, bill or notices, answering inquiries, classifying returns for audit, preparing reports and other matters concerned with the processing and enforcement activities of the IRS.
Initial inputs to BMF for each tax period are processed by a front-end input system (i.e. ISRP, e-file, etc.). These systems interface with the Generalized Mainline Framework (GMF) which provides the data to the BMF processing system.
Subsequent inputs are transactions that can originate in any number of IRS processing systems. Generally these system interface with the Integrated Data Retrieval System (IDRS)/ Integrated Case Processing (ICP) system processing runs which include End-of-Day (EOD) runs which validates the data before submitting to the BMF for posting.
Any input (initial or subsequent) which is unable to post to the master file for any reason, is returned to the originating system via the Generalized Unpostable Framework (GUF) for correction.
Posted data is replicated for use in other IRS processing systems. The entire BMF is replicated for Corporate Files On-line (CFOL), which provides on-line read-only access for authorized IRS employees. There are several files that contain extracts of entity data that are used in validation for processing or for employee access as a research tool in answering taxpayer inquiries or resolving compliance issues. These include the National Account Profile (NAP), the Taxpayer Index File (TIF) and the Name Search Facility (NSF).
MFTRA processing accesses the BMF directly. Other systems that receive BMF data do not access the BMF directly, but receive a file generated either by BMF OUTPUTS, 701 EXTRACTS, or MIS REPORTS. These include IDRS, Automated Collection System (ACS), Audit Information Management System (AIMS) and reports.
11. Have the IRS systems described in Item 10 received an approved Security Certification and Privacy Impact Assessment?
The mainframe system that provides the processing and storage capabilities for the tax processing system, including the Information Returns Processing System (IRP; IRMF and PMF), as well as Business Master File (BMF), Individual Master File (IMF), is preparing to undergo security testing and is expected to receive certification in November 2003. . A PIA was completed 7/03 for IRP, which included subsystems. IRP will need to be recertified in 2006. IDRS/ICP and GUF have PIAs. GMF, CFOL, NAP, TIF, ACS, and NSF do not.
12. Will other agencies provide, receive, or share data in any form with this system?
Yes. Financial Management Service (FMS) receives data from BMF for those accounts that have overpaid their liability. FMS provides data to BMF on taxpayers that have other outstanding federal liabilities that can or have been offset by their account overpayment.
13. What are the procedures for eliminating the data at the end of the retention period?
Annual end of year processing (Conversion) updates the BMF. An analysis is performed and based on factors such as the current status, the Assessment Expiration Date and Collection Expiration Date entity and tax modules are removed to the retention register.
14. Will this system use technology in a new way? If "YES" describe. If "NO" go to Question 15. No.
15. Will this system be used to identify or locate individuals or groups? If so, describe the business purpose for this capability.
Yes. The business purpose is to store accounts of business return filers and identify and locate taxpayers who are not in compliance with federal tax filing and payment requirements. The system accepts queries from other systems based on criteria that may indicate cases at high risk for non-compliance. The data are further analyzed by these other systems, and the results posted back to the master file.
16. Will this system provide the capability to monitor individuals or groups? If yes, describe the business purpose for this capability and the controls established to prevent unauthorized monitoring.
This system does not itself monitor individuals or groups. Other systems extract data from this repository. Extracts are performed only based on an approved request for information services.
17. Can use of the system allow IRS to treat taxpayers, employees, or others, differently? Explain.
No. The master file data allows IRS to ensure that taxpayers are treated equitably. The automated method of generating notices based on specific criteria eliminates the possibility of one taxpayer receiving preferential treatment over another or one taxpayer unfairly singled out for special scrutiny.
18. Does the system ensure "due process" by allowing affected parties to respond to any negative determination, prior to final action?
Yes. The BMF records the issuance of statutory notices. These notices may include math errors on a return, and other procedural notices sent to the taxpayer on initial processing. If another system accesses data in the BMF and subsequent processing by that other system results in a notice to the taxpayer, the notice is recorded on the BMF, which serves as the master repository. The other systems have procedures to ensure due process.
19. If the system is web-based, does it use persistent cookies or other tracking devices to identify web visitors? n/a
| 
